Handle bcvk zstd EFI zboot skips and enable push-triggered VM e2e

[foil-copy-overrate]

Motivation

• CI VM e2e runs were failing on ARM64 images that contain an EFI zboot kernel compressed with zstd, because bcvk cannot DirectBoot those kernels; the change makes that known harness limitation an explicit, non-failing skip so CI remains actionable.
• The VM e2e workflow should run on relevant repo pushes (workflow, tests, Containerfile/mkosi, and usr/ overlay changes) in addition to manual workflow_dispatch so regressions are caught earlier.

Description

• Added a push trigger to .github/workflows/ci_test-vm.yml for main and feat/** branches and for relevant paths (.github/workflows/ci_test-vm.yml, tests/vm/**, Containerfile, Containerfile.dev, mkosi.conf, mkosi.conf.d/**, usr/**).
• Updated tests/vm/test-luks-fido2-ci.sh and tests/vm/test-fido2-enrollment.sh to detect the known podman log string unable to handle EFI zboot image with "zstd" compression and exit with an explicit skip code 77 via a new skip_unsupported_zboot() helper.
• Taught the workflow step that runs each VM script to capture the script exit code and convert exit 77 into a GitHub Actions warning and summary entry instead of a failed job, while preserving failure behavior for any other nonzero exit code.
• Recorded the follow-up from the observed run (the zstd DirectBoot limitation) in TODO.md for visibility and tracking.

Testing

• Verified shell syntax for the VM scripts with bash -n tests/vm/test-luks-fido2-ci.sh tests/vm/test-fido2-enrollment.sh which succeeded.
• Validated the modified workflow YAML by loading it with ruby -e 'require "yaml"; YAML.load_file(".github/workflows/ci_test-vm.yml")' which succeeded.
• Ran git diff --check to sanity-check whitespace/merge artifacts which reported no issues.

---

Codex Task