this is a bit dangerous but necessary for more efficient delta updates.
we must be very careful to avoid a bug in systemd caused by putting
foo.erofs.caibx into the sha256sums. so instead we have foo.caibx that
gets installed with the correct name by sysupdate
we still have the foo.erofs.caibx on the server for backwards compat,
but continue to not put it into the sha256sums
otherwise we are not cleaning up raw images
unfortunately this also means we'll screw over the sha256sums in the
root a bit. not easily dealt with. needs some refactoring of how the v2
stuff works
the previous code would end up dropping the protected versions from the
shasums, we'll want to keep them there as well.
to achieve this we now collect all protected releases and then append
them to the keep list once the keep list has been pruned. seems the most
reliable way of doing this
