trim: omit unused GPU drivers + tighten firmware keep-list (TODO #18)

First trim build confirmed firmware 678 MB -> 147 MB, but the initramfs came
out 97 MB and is now kernel-MODULE-bound, not firmware: --no-hostonly +
plymouth's drm dep instmods every GPU driver (amdgpu.ko etc.) though the fleet
is i915-only.

- omit_drivers += amdgpu radeon nouveau (90-diskless.conf): drop the discrete-GPU
  kmods (amdgpu.ko is the biggest single module in the initramfs); keep i915 +
  virtio-gpu/bochs for the splash. Shrinks the initramfs/UKI pulled over PXE on
  every boot.
- Firmware keep-list tightened: drop mellanox/ (mlxsw_spectrum SWITCH-ASIC blobs,
  not NIC fw — mlx5 NIC fw is on-card) and narrow intel/ to just ice (drop
  ish/sof/ibt sensor-hub/audio/bluetooth, none loaded at boot per the audit).
- Add an 'initramfs largest files' diagnostic (sort lsinitrd.txt by size) so the
  next build shows what dominates the .img.

BENCH-VERIFY: kiosk still renders on the 820 (i915 kept); watch the new initramfs
largest-files log line for the post-omit size.

diskless.pkr.hcl

@@ -417,16 +417,23 @@ build {
       # plymouth's `drm` dep instmods a broad DRM set (i915/amdgpu/radeon/…) and
       # dracut bundles each module's firmware into the initramfs (amdgpu fw is the
       # classic UKI bloater), so trimming FIRST shrinks BOTH the rootfs erofs AND
-      # the UKI's initramfs. Keep i915 (all Intel gens) + intel/ (ice DDP for the
-      # ice/mlx5 server-NIC build variant + small Intel blobs) + mellanox +
-      # intel-ucode; strip the rest (~600 MB). Safe for the initramfs: the fleet
+      # the UKI's initramfs. Keep i915 (all Intel gens — the fleet's only
+      # firmware-loading GPU) + intel/ice (the ice server-NIC DDP, the SOLE intel/
+      # blob any host needs — ish/sof/ibt are sensor-hub/audio/bluetooth, none
+      # loaded at boot) + intel-ucode; strip the rest (~600 MB). NOT mellanox/ —
+      # those are mlxsw_spectrum SWITCH-ASIC blobs, not NIC firmware (mlx5 NIC fw is
+      # on-card, never request_firmware'd from /usr/lib/firmware), so they're dead
+      # weight even for an mlx5 build. Safe for the initramfs: the fleet
       # splash GPU (i915) fw is kept and the build-VM splash uses virtio-gpu/bochs
       # (no fw) — dracut just warns "firmware not found" for the removed drm modules
       # and continues. Risk asymmetry: missing NIC fw would brick the fleet (none
       # needed), missing GPU fw only degrades a display. BENCH-VERIFY the kiosk
       # renders on the 820. Strip-in-place (rm, not rpm -e): linux-firmware can't be
       # dropped as a package without also losing i915. See docs/TODO #18.
-      "if [ -d /usr/lib/firmware ]; then find /usr/lib/firmware -mindepth 1 -maxdepth 1 ! -name i915 ! -name intel ! -name mellanox ! -name intel-ucode -exec rm -rf {} + ; fi",
+      "if [ -d /usr/lib/firmware ]; then find /usr/lib/firmware -mindepth 1 -maxdepth 1 ! -name i915 ! -name intel ! -name intel-ucode -exec rm -rf {} + ; fi",
+      # Narrow intel/ to just ice (NIC DDP); drop ish (sensor hub), sof (audio DSP),
+      # ibt (bluetooth) etc. — none are loaded on this fleet (audit 2026-07-03).
+      "[ -d /usr/lib/firmware/intel ] && find /usr/lib/firmware/intel -mindepth 1 -maxdepth 1 ! -name ice -exec rm -rf {} + || true",
       # Wi-Fi firmware: wired-only fleet (no iwlwifi). Remove the packages cleanly
       # so the rpmdb stays honest (the find above dropped their iwlwifi-*.ucode).
       "dnf remove -y 'iwl*-firmware' 2>/dev/null || true",
@@ -449,6 +456,10 @@ build {
       # before dracut. See docs/TODO #18.
       "echo \"==> initramfs size: $(du -h /boot/initramfs-generic.img | cut -f1)\"",
       "echo '==> firmware bundled in initramfs (expect i915 only):'; grep -i '/firmware/' /tmp/lsinitrd.txt || echo '  (none)'",
+      # Largest files IN the initramfs (in-cpio size, before the outer zstd) — after
+      # the firmware strip the .img is module-bound (the --no-hostonly DRM/net/crypto
+      # set), so this surfaces the next trim targets (e.g. GPU driver kmods). See #18.
+      "echo '==> initramfs largest files:'; awk '/^-/{print $5, $NF}' /tmp/lsinitrd.txt | sort -rn | head -25",
       "grep -E 'macsec|wpa_supplicant|tpm2_nvread|nvme.tcp|erofs|veritysetup' /tmp/lsinitrd.txt",
       # Assert NetworkManager is in the initramfs — the network-manager dracut
       # module is what renews the DHCP lease post-switch-root. A missing/renamed