signing the android system.img is failing on the signers:
250317 07:43 DEBUG: RunCommand: /cros/vboot_reference/scripts/image_signing/sign_official_build.sh recovery /tmp/signer.LxLoqd/recovery_image.bin /cros/keys/SnappyPreMPKeys /tmp/signer.LxLoqd/chromeos_9334.21.0_snappy_recover
y_beta-channel_premp.bin /cros/keys/SnappyPreMPKeys/key.versions
...
INFO   : Start updating sepolicy
/tmp/tmp.qWBCpc129q/mnt/system/etc/security/mac_permissions.xml /tmp/tmp.Qa0MXb2dWm differ: byte 118, line 1
INFO   : Replacing OTA cert
INFO   : Reapplying file security context
/sbin/setfiles reset /tmp/tmp.qWBCpc129q/mnt/system/etc/security/mac_permissions.xml context ->u:object_r:system_file:s0
INFO   : Repacking squashfs image
Parallel mksquashfs: Using 2 processors
Creating 4.0 filesystem on /tmp/tmp.k1QLcpX0A1/opt/google/containers/android/system.raw.img, block size 131072.
Write failed because No space left on device
FATAL ERROR:Failed to write to output filesystem

testing this input:
gs://chromeos-releases/beta-channel/snappy/9334.21.0/ChromeOS-recovery-R58-9334.21.0-snappy.tar.xz

i ran the mksquashfs command by hand (it's the one that lives in the cros-signing repo), and indeed, it produces a larger file.

this is the one from the recovery image:
-rw-r--r-- 1 root root 484360192 Mar 25 06:55 /tmp/tmp.JwI0GU51sv/opt/google/containers/android/system.raw.img

and here's the one i ran by hand:
# /cros/signer/signingtools-bin/mksquashfs /tmp/tmp.d7wRZxU4jO/mnt /tmp/system.raw.img -no-progress -comp lzo -noappend
-rw-r--r-- 1 root root 525737984 Mar 25 22:51 /tmp/system.raw.img

it's because we use lzo but the original is using gzip.  and we no longer have the space for an lzo image.