Avoid mounting the built image with buildah (ran out of disk); the finalize.d hook records the rpm list next to the treefile and release.sh consumes it directly.