build: remove + mask firewalld (kickstart excludes it; weak-dep reinstall caused AVC flood)

http/ks.cfg excludes firewalld (-firewalld) and sets firewall --disabled — the
fleet's security boundary is the network (802.1X/MACsec + switch); the host
firewall is a documented OFF item (stig-deviations #4). But a provisioner dnf
pulled firewalld back as a weak dep (Recommends) and it starts by default. Its
Python then tries to rewrite site-package .pyc bytecode, which the reproducible
erofs -T 0 mtime reset makes look stale, so firewalld_t gets write/unlink AVCs
on lib_t that flood the SIEM.

Remove firewalld in 2d hygiene (weak dep, nothing hard-needs it) and mask it as
a backstop against future weak-dep reinstalls. No firewalld => no daemon, no
AVC, matches the kickstart intent.

diskless.pkr.hcl

@@ -867,6 +867,17 @@ build {
       # already downloaded to the host) — slims the erofs + cuts attack surface.
       # Keep auditd (it's part of the hardened runtime). Best-effort.
       "dnf remove -y openscap-scanner scap-security-guide openscap-utils 2>/dev/null || true",
+      # firewalld: the kickstart EXCLUDES it (-firewalld, firewall --disabled) —
+      # this fleet uses network-layer security (802.1X/MACsec + switch); the host
+      # firewall is a documented OFF item (docs/stig-deviations.md #4). But a
+      # provisioner dnf pulled it back as a WEAK dep (Recommends) and, once
+      # installed, it starts by default. Its Python then tries to rewrite
+      # site-package .pyc bytecode — which the reproducible erofs `-T 0` mtime
+      # reset makes look stale — so firewalld_t gets write/unlink AVCs on lib_t
+      # that flood the SIEM (seen 2026-07-03). Remove it (weak dep, nothing
+      # hard-needs it) and mask as a backstop against future weak-dep reinstalls.
+      "dnf remove -y firewalld 2>/dev/null || true",
+      "systemctl mask firewalld.service 2>/dev/null || true",
       # (No Go toolchain to remove — fleet-hostapi + fleet-enrol are built OUT OF
       # the VM on the CI runner and file-provisioned in as static binaries.)
       # The build-time STIG reports must not ship inside the read-only rootfs.