trim: drop nss-mdns (+ orphaned avahi) — media-independent mDNS resolver

Investigating avahi/samba/rabbitmq in the image: ldd on libavformat.so confirms
samba (libsmbclient), librabbitmq, librist, libsrt and libzmq are all DT_NEEDED
by FFmpeg's libavformat-free — removing any breaks libavformat and thus future
HTML5 media in the kiosk, so they stay. avahi is the exception: it's absent from
libavformat's links and 'rpm -e --test avahi' shows its only reverse-dep is
nss-mdns (the mDNS/.local NSS resolver).

The fleet resolves via DHCP/DNS (boot.fleet.lab), never .local, so mDNS is dead
weight and a network-listening service unwanted on a locked-down kiosk. Remove
nss-mdns; dnf's clean_requirements_on_remove reaps avahi/avahi-glib/avahi-libs as
orphans. Belt-and-braces alongside install_weak_deps=False (which already drops
nss-mdns if it came in as a Recommends).

diskless.pkr.hcl

@@ -941,6 +941,17 @@ build {
       # hard-needs it) and mask as a backstop against future weak-dep reinstalls.
       "dnf remove -y firewalld 2>/dev/null || true",
       "systemctl mask firewalld.service 2>/dev/null || true",
+      # nss-mdns: the mDNS/.local NSS resolver, and the ONLY reverse-dep of avahi
+      # (confirmed 2026-07-03: `rpm -e --test avahi` → "avahi is needed by nss-mdns",
+      # and avahi is absent from `ldd libavformat` so it's unrelated to Chromium's
+      # media stack — unlike samba/librabbitmq/librist/libsrt/libzmq, which ARE
+      # libavformat DT_NEEDED and must stay for future HTML5 media). This fleet
+      # resolves via DHCP/DNS (boot.fleet.lab), never .local, so mDNS is dead weight
+      # AND a network-listening service unwanted on a locked-down kiosk. Removing
+      # nss-mdns lets dnf's clean_requirements_on_remove reap avahi/avahi-glib/
+      # avahi-libs as orphans. (install_weak_deps=False may already drop nss-mdns if
+      # it's a Recommends; this is the belt-and-braces for the hard-dep case.)
+      "dnf remove -y nss-mdns 2>/dev/null || true",
       # (No Go toolchain to remove — fleet-hostapi + fleet-enrol are built OUT OF
       # the VM on the CI runner and file-provisioned in as static binaries.)
       # The build-time STIG reports must not ship inside the read-only rootfs.