mkosi: Fix particle profile

The sbsign and ukify part was moved into a finalize script
rather than a postinst.chroot script so was using host tools
instead of just-built.

mkosi.images/system/mkosi.conf.d/20-particle/mkosi.finalize

@@ -4,12 +4,3 @@ set -e
 
 mkdir -p "$BUILDROOT"/usr/share/factory/mkosi
 cp --archive --recursive --no-target-directory --reflink=auto "$BUILDROOT"/etc "$BUILDROOT"/usr/share/factory/mkosi
-
-# sbsign is not available on CentOS Stream
-if command -v sbsign &>/dev/null; then
-    # Ensure that side-loaded PE addons are loaded if signed, and ignored if not
-    addons_dir=/efi/loader/addons
-    mkdir -p "$addons_dir"
-    ukify build --secureboot-private-key mkosi.key --secureboot-certificate mkosi.crt --cmdline this_should_be_here -o "$addons_dir/good.addon.efi"
-    ukify build --cmdline this_should_not_be_here -o "$addons_dir/bad.addon.efi"
-fi

mkosi.images/system/mkosi.conf.d/20-particle/mkosi.postinst.chroot

@@ -0,0 +1,12 @@
+#!/bin/bash
+# SPDX-License-Identifier: LGPL-2.1-or-later
+set -e
+
+# sbsign is not available on CentOS Stream
+if command -v sbsign &>/dev/null; then
+    # Ensure that side-loaded PE addons are loaded if signed, and ignored if not
+    addons_dir=/efi/loader/addons
+    mkdir -p "$addons_dir"
+    ukify build --secureboot-private-key mkosi.key --secureboot-certificate mkosi.crt --cmdline this_should_be_here -o "$addons_dir/good.addon.efi"
+    ukify build --cmdline this_should_not_be_here -o "$addons_dir/bad.addon.efi"
+fi