root the build the pre-start check names

nix/vm-tests/agent-ephemeral-rootfs.nix

@@ -14,8 +14,9 @@
 #   - a package installed into the user's nix profile is still there, and on
 #     PATH, after a restart;
 #   - a link planted at `root` in the template refuses the next start through
-#     the limits drop-in's `ExecStartPre=` check, leaves the link's target
-#     untouched, and the start goes through once the link is gone.
+#     the limits drop-in's `ExecStartPre=` check (whose build has a GC root),
+#     leaves the link's target untouched, and the start goes through once the
+#     link is gone.
 #
 # The agent's journal forwarder itself (an OTLP push to the hive's collector) is
 # not booted here; the module-eval suite covers its wiring.
@@ -227,6 +228,9 @@ pkgs.testers.runNixOSTest {
             assert json.loads(out.strip().splitlines()[-1])["ok"] is True, out
         dropin = host.succeed(f"cat /run/systemd/system/container@{MACHINE}.service.d/hyperhive-limits.conf")
         assert "ExecStartPre=/nix/store/" in dropin and f"check-rootfs {MACHINE}\n" in dropin, dropin
+        # The build the drop-in names is rooted against garbage collection.
+        build = "/".join(dropin.split("ExecStartPre=")[1].split()[0].split("/")[:4])
+        assert host.succeed(f"readlink /nix/var/nix/gcroots/hyperhive-check-rootfs/{MACHINE}").strip() == build, build
 
         # `root` is a link to a directory outside the root, which the start
         # script would `chmod 0700` as host root.