pivot to a systemd unit for the online hook

files/dracut/95dot1x-macsec/nvmf-connect.service

@@ -0,0 +1,23 @@
+[Unit]
+Description=Connect NVMe-oF root namespace (test mode, rd.dot1x=0)
+Documentation=https://github.com/ (diskless fleet boot — open-network test path)
+DefaultDependencies=no
+# Open-network test path only; no-op when 802.1X/MACsec is enabled.
+ConditionKernelCommandLine=rd.dot1x=0
+After=systemd-udevd.service
+# Run before the root block device is required: connecting the namespace makes
+# /dev/disk/by-id/nvme-uuid.* appear so systemd-veritysetup can map
+# /dev/mapper/root. Networking (ip=dhcp) comes up in parallel; the ExecStart
+# script polls for it, so we deliberately do NOT order After the network here
+# (avoids depending on a sync point this initramfs may not reach).
+Before=initrd-root-device.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/bin/bash /usr/sbin/nvmf-connect
+# ExecStart self-limits to ~60s; keep the unit timeout above that.
+TimeoutStartSec=120
+
+[Install]
+WantedBy=initrd-root-device.target