Instead of returning the second-highest layer as the meta-layer, we can:

• explicitly label the meta layer as a label on the container config
• explicitly label the UKI as a label on the container config (probably by its fs-verity digest)
• have some kind of a nicer install-kernel command or so that defaults to unpacking in /boot. We could use that during the OS image build, but it would also allow for easier "upgrades" on running systems.