build: bind /dev + disable selinux relabel — losetup needs host loop devices

build/build-iso.sh

@@ -25,8 +25,10 @@ podman build -t veilor-build:latest "$REPO_ROOT/build"
 # ── Build ISO ──
 # --make-iso requires --privileged (loop devices, mount).
 podman run --rm --privileged \
-    -v "$REPO_ROOT:/work:Z" \
-    -v "$OUT_DIR:/out:Z" \
+    --security-opt label=disable \
+    -v /dev:/dev \
+    -v "$REPO_ROOT:/work" \
+    -v "$OUT_DIR:/out" \
     veilor-build:latest -c "
         set -e
         rm -rf /out/build-${DATE} /tmp/lmc