fix: export CHROOT/DISTRO/KVER to build-rootfs.sh + sanity guard (#21)

The dispatch in #20 ran build-rootfs.sh without exporting $CHROOT, so
inside the script it was empty — meaning '/' expansions like
`mv "$UNPACK/rootfs"/* "$CHROOT/"` resolved to '/' and the bazzite
rootfs went into the build container's root. Container-contained, but
the build failed with a confusing 'Device or resource busy' on
/etc/resolv.conf.

Two fixes:
- entrypoint exports DISTRO/CHROOT/KVER/ROOT_LABEL/EFI_LABEL when
  calling the per-distro script, and asserts $CHROOT non-empty.
- bazzite + batocera scripts have a top-of-file guard that bails if
  $CHROOT is unset, missing, or '/'.

Co-authored-by: mia26MAjFm <mia26MAjFm@users.noreply.github.com>

docker/image-builder/entrypoint.sh

@@ -32,8 +32,12 @@ elif [ -x "/repo/distros/${DISTRO}/build-rootfs.sh" ]; then
     # bypassed entirely. Most often used for OCI atomic images (bazzite via
     # skopeo+umoci) or pre-built rootfs images (batocera squashfs).
     echo "=== Building $DISTRO rootfs via distros/${DISTRO}/build-rootfs.sh ==="
+    [ -n "$CHROOT" ] || { echo "FATAL: \$CHROOT empty"; exit 1; }
+    mkdir -p "$CHROOT"
     rm -rf "$CHROOT"/* "$CHROOT"/.[!.]* 2>/dev/null || true
-    bash "/repo/distros/${DISTRO}/build-rootfs.sh"
+    DISTRO="$DISTRO" CHROOT="$CHROOT" KVER="$KVER" \
+        ROOT_LABEL="$ROOT_LABEL" EFI_LABEL="$EFI_LABEL" \
+        bash "/repo/distros/${DISTRO}/build-rootfs.sh"
 else
     echo "=== Building $DISTRO rootfs ==="
     # --- Stage files for distrobuilder's copy generators ---