Attach the cloud-init seed ISO only when the VM disk is created

cloud-init reads the seed on the first boot only, so the Linux launchers now
mount it just for the run that creates the overlay disk. The seed drive moves
from the config files to the launcher arguments.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

run-debian13.py

@@ -208,7 +208,8 @@ for firmware_file in (uefi_code, uefi_vars_template):
     if not firmware_file.is_file():
         die(f"required UEFI firmware was not found: {firmware_file}")
 
-if not seed_image.is_file():
+creating = not disk_image.is_file()
+if creating and not seed_image.is_file():
     seed_builder = script_dir / "seediso" / "debian13" / "build-seed.sh"
     if not is_executable(seed_builder):
         die(f"seed image is missing and builder is unavailable: {seed_builder}")
@@ -240,7 +241,7 @@ if pid_file.is_file():
             die(f"the virtual machine is already running (PID {old_pid}).")
     pid_file.unlink(missing_ok=True)
 
-if not disk_image.is_file():
+if creating:
     run(["qemu-img", "create", "-q", "-f", "qcow2", "-F", "qcow2",
          "-b", str(base_image), str(disk_image), disk_size])
     print(f"Created writable disk overlay: {disk_image}")
@@ -254,7 +255,6 @@ config_values = {
     "uefi_code": uefi_code_flash,
     "uefi_vars": uefi_vars,
     "disk_image": disk_image,
-    "seed_image": seed_image,
 }
 for key, value in config_values.items():
     # QEMU's config file parser has no escape syntax for quoted values.
@@ -285,6 +285,13 @@ qemu_args = [
     "-display", display_backend,
 ]
 
+if creating:
+    # cloud-init reads the seed ISO on the first boot only (the users, keys,
+    # network and packages it sets up stay on the disk), so it is attached only
+    # when the disk is created.
+    qemu_args += ["-drive", f"file={seed_image},if=none,id=seed0,format=raw,readonly=on",
+                  "-device", "virtio-blk-pci,drive=seed0"]
+
 print(f"Starting {host_arch} VM from {qemu_config_template} "
       f"and {qemu_platform_config}.", flush=True)
 vmforwards.print_forwards(forwards)