credentials: Restore DefaultDependencies=no for virtiofs

crates/kit/src/credentials.rs

@@ -38,11 +38,14 @@ pub fn guest_path_to_unit_name(guest_path: &str) -> String {
 /// guest path. The unit is configured to:
 /// - Mount type: virtiofs
 /// - Options: Include readonly flag if specified, plus SELinux context for RO mounts
-/// - Before=remote-fs.target to integrate with standard systemd mount ordering
+/// - DefaultDependencies=no to avoid ordering cycles and ensure early boot availability
+/// - Before=remote-fs.target and umount.target for proper ordering
 ///
 /// We use remote-fs.target rather than local-fs.target because virtiofs is
 /// conceptually similar to a "remote" filesystem - it requires virtio transport
 /// infrastructure to be available, similar to how NFS requires network.
+/// However, we keep DefaultDependencies=no and explicit After= ordering to ensure
+/// the mount happens early enough for other services that depend on it.
 ///
 /// Returns the complete unit file content as a string
 pub fn generate_virtiofs_mount_unit(
@@ -63,7 +66,10 @@ pub fn generate_virtiofs_mount_unit(
         "[Unit]\n\
          Description=Mount virtiofs tag {tag} at {path}\n\
          ConditionPathExists=!/etc/initrd-release\n\
-         Before=remote-fs.target\n\
+         DefaultDependencies=no\n\
+         Conflicts=umount.target\n\
+         Before=remote-fs.target umount.target\n\
+         After=systemd-remount-fs.service\n\
          \n\
          [Mount]\n\
          What={tag}\n\