fix: export CHROOT/DISTRO/KVER to build-rootfs.sh + sanity guard (#21)

The dispatch in #20 ran build-rootfs.sh without exporting $CHROOT, so
inside the script it was empty — meaning '/' expansions like
`mv "$UNPACK/rootfs"/* "$CHROOT/"` resolved to '/' and the bazzite
rootfs went into the build container's root. Container-contained, but
the build failed with a confusing 'Device or resource busy' on
/etc/resolv.conf.

Two fixes:
- entrypoint exports DISTRO/CHROOT/KVER/ROOT_LABEL/EFI_LABEL when
  calling the per-distro script, and asserts $CHROOT non-empty.
- bazzite + batocera scripts have a top-of-file guard that bails if
  $CHROOT is unset, missing, or '/'.

Co-authored-by: mia26MAjFm <mia26MAjFm@users.noreply.github.com>

distros/bazzite/build-rootfs.sh

@@ -11,6 +11,10 @@
 
 set -ex
 
+: "${CHROOT:?ERROR: \$CHROOT unset/empty}"
+[ -d "$CHROOT" ] || { echo "ERROR: \$CHROOT=$CHROOT not a directory"; exit 2; }
+case "$CHROOT" in /) echo "ERROR: refuse to operate on /"; exit 2 ;; esac
+
 # Bazzite is an OCI atomic image; bypass distrobuilder entirely.
 # DISTRO=bazzite      -> ghcr.io/ublue-os/bazzite:stable
 # DISTRO=bazzite-deck -> ghcr.io/ublue-os/bazzite-deck:stable