Make sure user provided cmdline is always last

Replaces #3158

mkosi/qemu.py

@@ -788,7 +788,15 @@ def finalize_state(config: Config, cid: int) -> Iterator[None]:
             p.unlink(missing_ok=True)
 
 
-def finalize_kernel_command_line_extra(config: Config) -> list[str]:
+def finalize_kernel_command_line(config: Config, kernel: Optional[Path], firmware: QemuFirmware) -> list[str]:
+    if kernel and (
+        KernelType.identify(config, kernel) != KernelType.uki
+        or not config.architecture.supports_smbios(firmware)
+    ):
+        cmdline = [*config.kernel_command_line]
+    else:
+        cmdline = []
+
     columns, lines = shutil.get_terminal_size()
     term = finalize_term()
 
@@ -1185,18 +1193,11 @@ def run_qemu(args: Args, config: Config) -> None:
 
         apply_runtime_size(config, fname)
 
-        if kernel and (
-            KernelType.identify(config, kernel) != KernelType.uki
-            or not config.architecture.supports_smbios(firmware)
-        ):
-            kcl = config.kernel_command_line + finalize_kernel_command_line_extra(config)
-        else:
-            kcl = finalize_kernel_command_line_extra(config)
-
+        kcl = []
         if kernel:
             cmdline += ["-kernel", kernel]
 
-            if any(s.startswith("root=") for s in kcl):
+            if any(s.startswith("root=") for s in finalize_kernel_command_line(config, kernel, firmware)):
                 pass
             elif config.output_format == OutputFormat.disk:
                 # We can't rely on gpt-auto-generator when direct kernel booting so synthesize a root=
@@ -1346,6 +1347,8 @@ def add_virtiofs_mount(
             elif kernel:
                 kcl += [f"systemd.set_credential_binary={k}:{payload}"]
 
+        kcl += finalize_kernel_command_line(config, kernel, firmware)
+
         if kernel and (
             KernelType.identify(config, kernel) != KernelType.uki
             or not config.architecture.supports_smbios(firmware)