Add container image sanity checks

Since we're building skopeo ourselves in the container image, and
we don't have any functional testing of that, perform a sanity check.

Change-Id: I362e97d1120f3ce6c6be85ccf6948ced763b6cc1

.zuul.yaml

@@ -242,6 +242,9 @@
     requires:
       - python-builder-3.11-bookworm-container-image
       - python-base-3.11-bookworm-container-image
+    ansible-split-streams: true
+    post-run:
+      - playbooks/image/test-image.yaml
     provides: zuul-container-image
     vars: &zuul_image_vars
       promote_container_image_method: intermediate-registry

playbooks/image/test-image.yaml

@@ -0,0 +1,11 @@
+# Sanity checks that our container image is built as expected
+
+- hosts: all
+  tasks:
+    - name: Test skopeo inside the executor bwrap
+      command: docker run --rm -i --privileged quay.io/zuul-ci/zuul-executor:latest zuul-bwrap /tmp skopeo copy docker://quay.io/zuul-ci/zuul:latest oci:test
+      register: skopeo_output
+    - name: Verify that skopeo ran correctly
+      assert:
+        that:
+          - "'Writing manifest to image destination' in skopeo_output.stdout"