Merge origin/main (trim-rpm) into optimise-ram

Combines the image trim (#18: langpack/firmware slim, kiosk weak-deps, nss-mdns
KEEP+mask-avahi fix, final kiosk-stack build guard) with optimise-ram's overlay-RAM
work (#17 fapolicyd db_max_size cap, .pyc unchecked-hash recompile).

Conflict resolutions:
- diskless.pkr.hcl (2d hygiene tail): kept BOTH additions — the .pyc recompile
  runs first (the 'must run last after every dnf' mutation), then the read-only
  FINAL GUARD (rpm -q kiosk stack) as the absolute last step. The nss-mdns fix
  (mask avahi, keep the package) auto-merged above the conflict — no regression.
- docs/TODO.md: kept both #17 (fapolicyd db_max_size) and #18 (image trim), as the
  #18 stack-note predicted.

docs/TODO.md

@@ -1561,3 +1561,73 @@ the kiosk weak-deps trim (commit `a193dc3`, ~100 fewer packages) shrinks the *ac
 is NOT a separate tmpfs, ties to #15's mount separation); `/var/log/{messages,audit}`
 grow unbounded in RAM (audit is local-only) — logrotate caps or SIEM offload on
 long-lived hosts.
+
+## [~] 18. Slim the image — locale + firmware (biggest erofs-size wins)
+
+**Finding (image-size audit via the 2b `rpm -qa --qf '%{SIZE}'` manifest, 2026-07-03):**
+the largest packages in the 534-package image are NOT the kiosk — they're base bloat:
+`linux-firmware` **678 MB**, `glibc-all-langpacks` **228 MB**, then chromium (370) +
+llvm-libs (129). The uncompressed erofs is read over NVMe/TCP on every boot of every
+host, so every dead byte is fleet-wide waste + attack surface.
+
+**[x] DONE — glibc langpacks → en-only** (`diskless.pkr.hcl` step 2). `@^minimal-environment`
+pulls `glibc-all-langpacks` (all languages); swapped for `glibc-minimal-langpack` +
+`glibc-langpack-en`. ~220 MB reclaimed; image is English-only (we also strip
+`/usr/share/locale` in 2d). **BENCH-VERIFY:** locale still `en_US.UTF-8`; kiosk + login OK.
+
+**[x] DONE — linux-firmware strip to a hardware-audited keep-list** (`diskless.pkr.hcl`
+step 2, run **BEFORE the dracut build** so the UKI initramfs shrinks too — not just the
+rootfs. `--no-hostonly` + plymouth's `drm` dep instmods a broad DRM set and dracut bundles
+each module's firmware into the initramfs, amdgpu being the classic UKI bloater; the strip
+runs first so dracut never sees it. A post-build diagnostic reports the `.img` size + any
+firmware still bundled — expected i915 only.)
+Live fleet audit (`modinfo -F firmware` over all loaded modules + sysfs/`lspci` driver
+bindings on the real 820-class hosts AND the VMs) proved the **only** loadable firmware
+any host requests is Intel **i915** (GPU). Every other driver is firmware-free —
+crucially **e1000e** (on-chip NVM, not a fw file) and **virtio_net**, so NO NIC needs
+firmware and the fleet-brick case is off the table. Keep-list: `i915` + `intel/` (ice
+DDP insurance for the `ice`/`mlx5` server-NIC build variant + small Intel blobs) +
+`mellanox` + `intel-ucode`; strip the rest (amdgpu/nvidia/radeon/ath/qcom/rtl/iwlwifi…
+~600 MB). Wi-Fi (`iwl*-firmware`, ~83 MB) removed as packages (wired-only fleet).
+Strip-in-place (`find … -exec rm -rf`, not `rpm -e` — can't drop the package without
+losing i915); a `du -sh /usr/lib/firmware` line reports the result in the build log.
+**BENCH-VERIFIED 2026-07-03 (commit `f59eb79`): built, booted, AND the kiosk SPA RENDERS
+on both the VM (virtio-gpu) and the 820 (i915).** This clears the firmware strip's one
+real risk — the i915 DMC/GuC blobs load on real hardware, so the keep-list
+(i915/intel/mellanox/intel-ucode, pre-dracut) is validated end-to-end (firmware 678→147 MB,
+initramfs bundles only the keep-list). Remaining caveat: if a future host has a non-Intel
+GPU or an `ice`/`mlx5` NIC, widen the keep-list before trusting fleet-wide. **NOT yet in
+`f59eb79`** (bench-verify separately — none touch i915, so render should be safe): the
+`nss-mdns`/avahi drop (`5cc72cc`) and the `omit_drivers` GPU-kmod trim + keep-list
+tightening — dropped `mellanox/`, narrowed `intel/` to `ice` only (`853ae20`). Audited
+models: HP-820-class (i915 + e1000e + iwlwifi-dropped) and virtio VMs.
+
+**Build-verified 2026-07-03:** firmware **678 MB → 147 MB**; the initramfs diagnostic
+confirms only the keep-list is bundled (i915 all-gens + intel/ice + intel/ish + mellanox)
+— proving the pre-dracut ordering works. But the initramfs came out **97 MB**, and it's
+now **kernel-MODULE-bound, not firmware** (~10 MB fw): the `--no-hostonly` + plymouth
+`drm` set pulls every GPU driver (`amdgpu.ko` etc.) even though the fleet is i915-only.
+
+**[x] DONE — follow-on trims (2026-07-03):**
+- **`omit_drivers+=" amdgpu radeon nouveau "`** in `90-diskless.conf` — drops the
+  discrete-GPU kmods plymouth's `drm` dep would instmod (amdgpu.ko is the biggest single
+  module); keeps i915 + virtio-gpu/bochs for the splash. Targets the 97 MB initramfs/UKI.
+- **Firmware keep-list tightened**: dropped `mellanox/` (those are `mlxsw_spectrum`
+  SWITCH-ASIC blobs, NOT NIC fw — mlx5 NIC fw is on-card) and narrowed `intel/` to just
+  `ice` (dropped ish/sof/ibt = sensor-hub/audio/bluetooth, none loaded at boot).
+- **Initramfs top-25-files diagnostic** added after the dracut build (sorts `lsinitrd.txt`
+  by size) so the next build shows what dominates the `.img` — measure before the next cut.
+- **BENCH-VERIFY:** kiosk still renders on the 820 (i915 kept); check the new
+  "initramfs largest files" log line for the post-omit size + next targets.
+
+**Combined:** ~**800 MB** off the uncompressed erofs (langpacks + firmware), dwarfing the
+kiosk weak-deps trim (#4), plus a smaller UKI/initramfs from the DRM-driver omit. NEXT
+candidates from the manifest (measure, don't guess): `iso-codes` (19 MB),
+`samba-client-libs`/`intel-mediasdk`/`gstreamer` (chromium-common HARD deps — only
+removable by dropping HTML5 media, and samba/rabbitmq/rist/srt/zmq are libavformat
+DT_NEEDED so they can't go without breaking future media — confirmed via ldd 2026-07-03),
+`binutils` (25 MB, build-only?), `cracklib-dicts` (9.8 MB, needed for pam pwquality — keep).
+
+**Stack note:** committed on `trim-rpm`. When `optimise-ram` rebases onto the new
+`trim-rpm`, expect a trivial `docs/TODO.md` tail conflict (both branches appended after
+#16 — `optimise-ram` added #17 fapolicyd, this added #18); resolve by keeping both.