[Bug] Maybe official atomic-desktop-gnome-amd64.iso ships with broken bootc update policy

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Current Behavior

When installing the official `atomic-desktop-gnome-amd64.iso` image, available in the AlmaLinux Atomic Desktop GitHub repository, it was not possible to update the system (bootc) because the container signature policy is defective.

The ISO installs AlmaLinux Atomic Desktop GNOME version:

```text
10.1.20260321.1
```

After installation, running `bootc update` fails with:

```text
error: Upgrading: Preparing import: Fetching manifest: containers-policy.json specifies a default of `insecureAcceptAnything`; refusing usage
```

## Installation source

The system was installed from the official ISO:

```text
atomic-desktop-gnome-amd64.iso
```

The ISO was downloaded from the AlmaLinux Atomic Desktop GitHub repository.

## Steps to reproduce

1. Install AlmaLinux Atomic Desktop GNOME using the official:

```text
atomic-desktop-gnome-amd64.iso
```

2. Log in to the installed system.

3. Run:

```bash
sudo bootc update
```

4. Observe:

```text
error: Upgrading: Preparing import: Fetching manifest: containers-policy.json specifies a default of `insecureAcceptAnything`; refusing usage
```

## Original installed deployment

```text
Booted image: quay.io/almalinuxorg/atomic-desktop-gnome:latest
Digest: sha256:22cbc7dbde1bada31729f1cde8359a519fece18f5184cb1419b08277d73ee671
Version: 10.1.20260321.1
```

## Relevant policy

The installed `/etc/containers/policy.json` contained:

```json
{
"default": [
{
"type": "insecureAcceptAnything"
}
],
"transports": {
"docker": {
"quay.io/almalinuxorg/atomic-desktop-gnome": [
{
"type": "sigstoreSigned",
"keyPaths": [
"/etc/pki/containers/atomic-desktop-gnome.pub",
"/etc/pki/containers/atomic-sig-backup.pub"
],
"signedIdentity": {
"type": "matchRepository"
}
}
]
}
}
}
```

## Workaround

The issue was resolved by rebasing to a newer image:

```bash
sudo bootc switch quay.io/almalinuxorg/atomic-desktop-gnome
```

After the rebase, the system booted successfully and the newer deployment was:

```text
Booted image: quay.io/almalinuxorg/atomic-desktop-gnome
Digest: sha256:fbb56140f5b2b95b3386d48164665922b7a2cf8569af7271b6362fd3ac39c38a
Version: 10.2.20260808.1
```

The resulting deployments were:

```text
● ostree-unverified-registry:quay.io/almalinuxorg/atomic-desktop-gnome
Version: 10.2.20260808.1

ostree-image-signed:docker://quay.io/almalinuxorg/atomic-desktop-gnome:latest
Version: 10.1.20260321.1
```

## Expected behavior

A system installed from the official ISO should be able to update with:

```bash
sudo bootc update
```

without requiring a manual rebase.

## Suggested resolution

Please consider:

1. Publishing a newer `atomic-desktop-gnome-amd64.iso`.
2. Updating the ISO to install the current image.
3. Correcting the default container policy in the ISO so that it does not use:

```json
"type": "insecureAcceptAnything"
```

## Additional information

The current bootc status after the workaround was:

```text
StateRoot: default
Deploy serial: 0
Staged: no
Commit: 80832a097ec22f02981406a1f39133a10e14085d24f4721c95f914a154f94e05
Soft-reboot: yes
```

Environment:

```text
Distribution: AlmaLinux Atomic Desktop GNOME
Architecture: amd64
Initial image version: 10.1.20260321.1
Current image version: 10.2.20260808.1
```

### Expected Behavior

_No response_

### Steps To Reproduce

_No response_

### Anything else?

_No response_

### Search terms

bootc, bootc-update, atomic-desktop-gnome, containers-policy