trim: fix SIGPIPE (exit 141) in the initramfs-largest-files diagnostic

853ae20's diagnostic did 'awk … | sort -rn | head -25'. head closes the pipe
after 25 lines, sort dies of SIGPIPE (141), and step 2's set -euxo pipefail turns
that into a build failure (the exact trap the lsinitrd '| grep -q' comment warns
about). The kiosk step's rpm-manifest '| head' is safe only because that step
runs plain set -e, no pipefail.

Fix with the codebase convention: sort into a file, then head the file — no live
pipe for head to break. (Bonus: the crash log confirms omit_drivers worked —
amdgpu/radeon/nouveau kmods are gone from the top-25; the new biggest initramfs
item is GenuineIntel.bin CPU microcode at 22 MB, a future trim candidate.)

diskless.pkr.hcl

@@ -459,7 +459,12 @@ build {
       # Largest files IN the initramfs (in-cpio size, before the outer zstd) — after
       # the firmware strip the .img is module-bound (the --no-hostonly DRM/net/crypto
       # set), so this surfaces the next trim targets (e.g. GPU driver kmods). See #18.
-      "echo '==> initramfs largest files:'; awk '/^-/{print $5, $NF}' /tmp/lsinitrd.txt | sort -rn | head -25",
+      # Sort into a FILE then head the file — NOT `sort | head`: head closes the pipe
+      # after 25 lines, sort dies of SIGPIPE (exit 141), and step 2's
+      # `set -euxo pipefail` turns that into a build failure (same trap as the
+      # lsinitrd `| grep -q` note above). (The kiosk step's rpm-manifest `| head` is
+      # safe only because that step runs plain `set -e`, no pipefail.)
+      "echo '==> initramfs largest files:'; awk '/^-/{print $5, $NF}' /tmp/lsinitrd.txt | sort -rn > /tmp/initrd-sizes.txt; head -25 /tmp/initrd-sizes.txt; rm -f /tmp/initrd-sizes.txt",
       "grep -E 'macsec|wpa_supplicant|tpm2_nvread|nvme.tcp|erofs|veritysetup' /tmp/lsinitrd.txt",
       # Assert NetworkManager is in the initramfs — the network-manager dracut
       # module is what renews the DHCP lease post-switch-root. A missing/renamed