Adding Plymouth

CLAUDE.md

@@ -161,9 +161,10 @@ instead of working around it.
   `network-manager` module hands its initramfs connections to the real-root NM
   (state under `/run/NetworkManager`), which renews the lease. No more
   `dhcp-client`/`dhclient` (deprecated). The hook drives macsec0 DHCP via `nmcli`
-  (not `ifup`). See invariant on the managed/unmanaged split. BENCH-VERIFY: lease
-  actually renews past expiry (test path); macsec0 managed + `en*` unmanaged with
-  MKA surviving switch-root (secure path).
+  (not `ifup`). See invariant on the managed/unmanaged split. Test path
+  VERIFIED on the bench 2026-06-17 (lease renews past expiry; host stays up).
+  STILL BENCH-VERIFY when `disable_dot1x=false`: macsec0 managed + `en*`
+  unmanaged with MKA surviving switch-root (secure path).
 - Writable root overlay is `systemd.volatile=overlay`, **not** `rootovl`:
   RHEL/Rocky dracut ships no `overlayfs`/`rootovl` module. Needs
   `systemd-volatile-root.service` in the initramfs (bundled by recent dracut;
@@ -194,6 +195,14 @@ These bit us bringing the build up on Rocky 9.8; they are easy to regress.
   stack stays in the image, dormant. The matching lab DHCP/HTTP/NVMe-oF serving
   stack lives in `serving/` (docker compose). Re-enable security by dropping the
   var / setting `DISABLE_DOT1X: "false"` in the CI workflow.
+- **Boot splash toggle**: `boot_splash=true` (default) bakes `rhgb quiet` for a
+  Plymouth graphical splash (theme `spinner`, set in the provisioner); `false`
+  bakes `plymouth.enable=0` for a verbose console boot — keep it OFF while
+  debugging the boot chain. Plymouth is always in the image + initramfs (the
+  `plymouth` dracut module, which pulls `drm`); only the cmdline changes. CI
+  currently sets `BOOT_SPLASH: "false"` during the network-manager bench-verify.
+  Press ESC at boot to see details behind a splash. ks.cfg no longer excludes
+  `plymouth`.
 
 ## Testing changes