Attach the cloud-init seed ISO only when the VM disk is created

cloud-init reads the seed on the first boot only, so the Linux launchers now
mount it just for the run that creates the overlay disk. The seed drive moves
from the config files to the launcher arguments.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

run-almalinux10.py

@@ -208,7 +208,8 @@ for firmware_file in (uefi_code, uefi_vars_template):
     if not firmware_file.is_file():
         die(f"required UEFI firmware was not found: {firmware_file}")
 
-if not seed_image.is_file():
+creating = not disk_image.is_file()
+if creating and not seed_image.is_file():
     seed_builder = script_dir / "seediso" / "almalinux10" / "build-seed.sh"
     if not is_executable(seed_builder):
         die(f"seed image is missing and builder is unavailable: {seed_builder}")
@@ -240,7 +241,7 @@ if pid_file.is_file():
             die(f"the AlmaLinux virtual machine is already running (PID {old_pid}).")
     pid_file.unlink(missing_ok=True)
 
-if not disk_image.is_file():
+if creating:
     run(["qemu-img", "create", "-q", "-f", "qcow2", "-F", "qcow2",
          "-b", str(base_image), str(disk_image), disk_size])
     print(f"Created writable disk overlay: {disk_image}")
@@ -261,12 +262,17 @@ qemu_args = [
     "-drive", f"if=pflash,format=raw,file={uefi_vars}",
     "-drive", f"file={disk_image},if=none,id=disk0,format=qcow2",
     "-device", "virtio-blk-pci,drive=disk0",
-    "-drive", f"file={seed_image},if=none,id=seed0,format=raw,readonly=on",
-    "-device", "virtio-blk-pci,drive=seed0",
     "-netdev", vmforwards.netdev_argument(forwards),
     "-device", "virtio-net-pci,netdev=net0",
 ]
 
+if creating:
+    # cloud-init reads the seed ISO on the first boot only (the users, keys,
+    # network and packages it sets up stay on the disk), so it is attached only
+    # when the disk is created.
+    qemu_args += ["-drive", f"file={seed_image},if=none,id=seed0,format=raw,readonly=on",
+                  "-device", "virtio-blk-pci,drive=seed0"]
+
 if machine_type == "virt":
     # Unlike q35, the "virt" machine has no default GPU or USB input devices.
     qemu_args += [