fix(kernel-install): sign installed kernel, not source image

For layout=grub, $KERNEL_IMAGE ($4) points to the source kernel
(e.g. /lib/modules/.../vmlinuz -> build tree bzImage), not the copy
that 90-compat.install places at /boot/kernel-<version>. Sign the
installed copy that GRUB actually boots from.