manifests: enable cliwrap

As part of the bootable containers effort, we want to put emphasis on a
consistent experience when deriving images. A big part of that is being
able to type `dnf install -y ...` in one's `Containerfile`.

Let's turn on cliwrap for this. This was previously agreed[[1]], but
we ended never shipping it since there was a less invasive way to test
it.[[2]] Here, we bundle it as part of the Fedora 40 rebase. This will
naturally allow it to bake in `branched` and `next` for a while before
making it to `stable`.

Eventually, once dnf5 is ready, it could take on this role (including
package layering on the client-side), at which point we will no longer
need to wrap it.

[1]: coreos#830 (comment)
[2]: coreos#830 (comment)

manifests/cliwrap.yaml

@@ -0,0 +1,2 @@
+# https://github.com/coreos/fedora-coreos-tracker/issues/730
+cliwrap: true

manifests/fedora-coreos.yaml

@@ -33,6 +33,8 @@ conditional-include:
     # Remove this once we have Podman v5 in f39.
     # xref: https://github.com/coreos/fedora-coreos-tracker/issues/1629
     include: cni-plugins.yaml
+  - if: releasever >= 40
+    include: cliwrap.yaml
 
 ostree-layers:
   - overlay/15fcos

tests/kola/extensions/package

@@ -52,3 +52,8 @@ if [[ -n "${failed}" ]]; then
   fatal "could not install: ${failed}"
 fi
 ok "successfully installed os rpm package extensions"
+
+# also try the wrapped dnf
+
+dnf install -y 'ltrace'
+ok "dnf cliwrap"