reduce overlay RAM + kill .pyc AVC churn (TODO #16 item2, #17)

Two fixes from the booted-host overlay RAM audit (2026-07-03). The writable
root overlay (systemd.volatile=overlay, tmpfs) held 124.5 MiB of runtime
writes; almost all of it is runtime-regenerated state, not real fs deltas.

1. fapolicyd db_max_size 100 -> 50 (TODO #17). /var/lib/fapolicyd/data.mdb was
   100 MiB fully allocated (~80% of the overlay). fapolicyd's LMDB trust DB is
   rebuilt at boot onto the overlay, so db_max_size is a fixed RAM reservation.
   Sed it to 50 before the fapolicyd-cli --update rebuild. 50 was fapolicyd's
   long-time upstream default (covered a full workstation rpmdb), so it has
   headroom for this smaller image. Reclaims ~50 MiB.
   BENCH-VERIFY (STIG-critical exec guard): boot + kiosk + admin SSH + sudo +
   custom-binary exec must work (undersize -> MDB_MAP_FULL bricks exec).

2. .pyc invalidation fix (TODO #16 item 2). erofs -T 0 zeroes mtimes, so
   Python thinks every baked .pyc is stale and rewrites it into the overlay at
   runtime (wasting RAM + throwing lib_t write/unlink AVCs that flood the SIEM).
   Observed trigger: dnf-makecache.timer (~10 min post-boot) re-importing the
   dnf Python stack. Fix both ends: (a) compileall --invalidation-mode
   unchecked-hash over /usr/lib*/python3.* at the end of 2d (mtime-independent
   .pyc, no rewrite, also more reproducible); (b) mask dnf-makecache.timer next
   to the existing rhsmcertd mask (removes the trigger). Firewalld enablement
   (#16 items 1 & 3) still open.

diskless.pkr.hcl

@@ -383,6 +383,17 @@ build {
       # AVC in Wazuh — that would also hide future rhsmcertd_t denials.)
       "systemctl mask rhsmcertd.service 2>/dev/null || true",
       "systemctl disable rhsmcertd.service 2>/dev/null || true",
+      # Same class of noise, different trigger: dnf-makecache.timer fires ~10 min
+      # after boot and imports the whole dnf Python stack (dnf/libdnf/librepo/rhsm).
+      # Because the reproducible erofs `-T 0` reset makes every source .py look
+      # newer than its baked .pyc, that import REWRITES bytecode into the tmpfs
+      # overlay (measured 2026-07-03: ~MBs of dnf/libdnf/rhsm __pycache__) and
+      # throws lib_t write/unlink AVCs. An immutable diskless host never refreshes
+      # dnf caches (no persistent store, no runtime installs), so mask the timer to
+      # remove the trigger. Belt-and-braces with the compileall unchecked-hash step
+      # in 2d (which stops the rewrite at the source). See docs/TODO.md #16.
+      "systemctl mask dnf-makecache.timer 2>/dev/null || true",
+      "systemctl disable dnf-makecache.timer 2>/dev/null || true",
       # Read-only erofs/verity root; runtime state on a tmpfs overlay provided
       # by systemd.volatile=overlay (set in the cmdline by extract-artifacts.sh).
       # RHEL/Rocky dracut has no 'overlayfs'/'rootovl' module.
@@ -812,6 +823,21 @@ build {
       # custom kiosk files: add them to fapolicyd's trust DB and rebuild it. weston
       # /chromium are RPM-installed so already trusted. (See docs/stig-deviations.md.)
       "if command -v fapolicyd-cli >/dev/null 2>&1; then",
+      # RAM: fapolicyd's LMDB trust DB is rebuilt at BOOT onto the tmpfs overlay,
+      # so its map size (db_max_size, in MB) is a fixed RAM RESERVATION, not a
+      # ceiling it grows into. The EL9 default (100) was measured consuming a real
+      # 100 MiB of overlay RAM on a booted host (2026-07-03) — ~80% of the entire
+      # overlay. The minimal+kiosk trust set is a fraction of that (fapolicyd
+      # upstream shipped db_max_size=50 for years as the default that covers a
+      # FULL workstation rpmdb, which is larger than this image). Halve it to
+      # reclaim ~50 MiB. MUST run before the --update below so the rebuilt db uses
+      # the smaller map. BENCH-VERIFY the exec-guard still works end-to-end (boot +
+      # kiosk render + admin SSH + sudo): undersize this and fapolicyd hits
+      # MDB_MAP_FULL, allowlisting breaks, and login/kiosk exec is bricked (keep
+      # fapolicyd working — it's the writable-overlay exec guard dm-verity can't
+      # provide). Can drop lower after measuring `fapolicyd-cli --dump | wc -l` on
+      # the bench; see docs/TODO.md.
+      "  if [ -f /etc/fapolicyd/fapolicyd.conf ]; then sed -ri 's/^[[:space:]]*#?[[:space:]]*db_max_size[[:space:]]*=.*/db_max_size = 50/' /etc/fapolicyd/fapolicyd.conf; grep -q '^db_max_size' /etc/fapolicyd/fapolicyd.conf || printf 'db_max_size = 50\\n' >> /etc/fapolicyd/fapolicyd.conf; echo '==> fapolicyd: db_max_size set to 50 MiB (was EL9 default ~100)'; fi",
       "  for f in /usr/local/bin/kiosk-session /usr/local/bin/fleet-sb-enroll /usr/local/bin/fleet-hostapi /usr/sbin/fleet-enrol; do { [ -f \"$f\" ] && fapolicyd-cli --file add \"$f\"; } || true; done",
       "  fapolicyd-cli --update 2>/dev/null || true",
       "  echo '==> fapolicyd: trusted custom binaries (kiosk-session, fleet-sb-enroll, fleet-hostapi) + rebuilt trust db'",
@@ -914,6 +940,22 @@ build {
       "if [ -d /usr/lib64/chromium-browser/locales ]; then find /usr/lib64/chromium-browser/locales -type f -name '*.pak' ! -name 'en-US.pak' -delete; fi",
       # App translation catalogs (.mo) for locales this fleet never uses.
       "[ -d /usr/share/locale ] && find /usr/share/locale -mindepth 1 -maxdepth 1 -type d ! -name 'en*' ! -name 'C*' -exec rm -rf {} + || true",
+      # .pyc invalidation vs reproducible mtimes: the erofs is built `-T 0`, which
+      # zeroes every file's mtime. Python's DEFAULT .pyc invalidation is
+      # timestamp-based (the .pyc header stores the source's mtime), so at runtime
+      # every source .py looks newer than its baked .pyc and Python recompiles into
+      # the tmpfs overlay — wasting RAM and, under enforcing SELinux, throwing
+      # lib_t write/unlink AVCs (seen 2026-07-03: dnf/libdnf/rhsm __pycache__
+      # rewrites 10 min after boot). Recompile ALL bytecode with hash-based,
+      # UNCHECKED invalidation: the .pyc then carries a source hash flagged
+      # 'do not check', so Python loads it WITHOUT stat-ing the source, and never
+      # rewrites regardless of the `-T 0` mtimes. Bonus: hash .pyc embed no mtime,
+      # so they're more reproducible than timestamp .pyc (reinforces the -T 0
+      # invariant). MUST run LAST (after every dnf install/remove) so nothing lays
+      # down a fresh timestamp .pyc afterward; -f forces existing .pyc to this mode.
+      # Version-agnostic loop so an EL point-release python bump doesn't silently
+      # skip it. See docs/TODO.md #16.
+      "for d in /usr/lib/python3.* /usr/lib64/python3.*; do [ -d \"$d\" ] && python3 -m compileall -f -q --invalidation-mode unchecked-hash \"$d\" 2>/dev/null || true; done",
     ]
   }