split out hash because rocky doesnt support it inline

CLAUDE.md

@@ -100,10 +100,12 @@ instead of working around it.
    When adding a runtime dependency to the hook, add it to the dracut
    module’s `install()` *and* extend the lsinitrd assertion.
 1. **The OCI artifact image stays FROM scratch.** Only
-   `/artifacts/{fleet-<ver>.efi, rootfs.erofs, verity.json, SHA256SUMS}`.
-   No shell, no tools, no base image. Serving software (SPDK, nginx) lives
-   in separate, independently versioned images — never merge them into the
-   artifact image.
+   `/artifacts/{fleet-<ver>.efi, rootfs.erofs, rootfs.hash, verity.json,
+   SHA256SUMS}`. `rootfs.erofs` (erofs data) and `rootfs.hash` (dm-verity hash
+   tree) are **separate** namespaces because the as-built Rocky 9 systemd does
+   not support the in-file `hash-offset` verity layout. No shell, no tools, no
+   base image. Serving software (SPDK, nginx) lives in separate, independently
+   versioned images — never merge them into the artifact image.
 1. **Deployments are pinned by digest.** One commit per fleet release in
    the deployment manifest; that manifest is the single source coupling
    UKI ↔ namespace. Rollback = revert the commit.
@@ -128,8 +130,12 @@ instead of working around it.
   build; the supplicant config carries both options.
 - erofs module availability on the target RHEL kernel (fallback:
   journal-less ext4 in `extract-artifacts.sh`).
-- `systemd.verity_root_options=hash-offset` support in the shipped systemd
-  (fallback: split data/hash into two namespaces).
+- `systemd.verity_root_options=hash-offset` is **NOT supported** by Rocky 9.8
+  systemd-veritysetup (verified: "unknown option hash-offset=" → "Failed to load
+  verity superblock"). Resolved by the documented fallback — data and hash are
+  **two separate NVMe namespaces** (`rootfs.erofs` + `rootfs.hash`, distinct
+  pinned UUIDs), so the cmdline uses plain `systemd.verity_root_data=` /
+  `systemd.verity_root_hash=` by-id devices with no offset.
 - `network-legacy` dracut module needs `dhclient`; RHEL 9 omits it from the
   minimal install, so the provisioner installs `dhcp-client` (without it dracut
   fails "module network-legacy can't be installed"). dhclient is deprecated —