We want bootc to support both "generic, unlocked" systems that have persistent mutable state in /etc, as well as "sealed" systems that are only configured via bootc, and shouldn't have persistent mutable configuration.

(Similar, for /var, though in the general case for that I think people will instead want to allow-list at least some persistent paths, like the journal)