fix(linux/build): xorriso -extract needs -osirrox on (M1.1 iter28)

Run #4275's TOC parser worked perfectly — found
/live/filesystem.squashfs as the largest file (983,547,904 bytes,
right where it should be) — but extraction still bailed:

    diagnose: largest file in ... is /live/filesystem.squashfs; extracting
    diagnose: could not extract rootfs from A

xorriso's -extract action requires -osirrox to be turned on at the
start of the command line; without it, -extract is silently rejected
("OSIRROX is not enabled by default. -osirrox on permits it."). Our
script swallowed stderr and the only signal was the empty output
file.

Two changes:
  * Add `-osirrox on` to every -extract invocation.
  * On extraction failure, surface the captured stderr (last 30
    lines) into the workflow log instead of dropping it. Saves us
    one round-trip if the next thing breaks.

ISO layout from the iter27 dump for the record:
    /live/filesystem.squashfs   983547904 bytes  ← rootfs
    /live/initrd.img-...         62929840 bytes
    /live/vmlinuz-...            12113856 bytes
    /boot/grub/efi.img            3342336 bytes
    /EFI/boot/{boot,grub}x64.efi
    + grub modules under /boot/grub/{i386-pc,x86_64-efi}/

The named-path probe for /live/filesystem.squashfs was already first
in the list — it'll succeed cleanly now and we skip the largest-file
fallback.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

linux/build/scripts/diagnose-divergence.sh

@@ -126,12 +126,15 @@ extract_squashfs() {
     if ! command -v xorriso >/dev/null 2>&1; then return 1; fi
 
     # Try canonical Debian/Kicksecure layout first.
+    local err_log; err_log=$(mktemp)
     for path in /live/filesystem.squashfs /casper/filesystem.squashfs \
                 /filesystem.squashfs /install/filesystem.squashfs \
                 /boot/filesystem.squashfs ; do
-        if xorriso -indev "${iso}" -extract "${path}" "${out}" 2>/dev/null \
+        if xorriso -osirrox on -indev "${iso}" -extract "${path}" "${out}" \
+                2>"${err_log}" \
             && [[ -s "${out}" ]]; then
             echo "diagnose: extracted ${path} from $(basename "${iso}")" >&2
+            rm -f "${err_log}"
             return 0
         fi
     done
@@ -143,11 +146,17 @@ extract_squashfs() {
     biggest=$(biggest_file "${iso}")
     if [[ -n "${biggest}" ]]; then
         echo "diagnose: largest file in $(basename "${iso}") is ${biggest}; extracting" >&2
-        if xorriso -indev "${iso}" -extract "${biggest}" "${out}" 2>/dev/null \
+        if xorriso -osirrox on -indev "${iso}" -extract "${biggest}" "${out}" \
+                2>"${err_log}" \
             && [[ -s "${out}" ]]; then
+            rm -f "${err_log}"
             return 0
         fi
     fi
+    # If we got here, extraction failed; surface the error.
+    echo "diagnose: xorriso -extract stderr (last 30 lines):" >&2
+    tail -n 30 "${err_log}" >&2 || true
+    rm -f "${err_log}"
     return 1
 }