trim: omit unused GPU drivers + tighten firmware keep-list (TODO #18)

First trim build confirmed firmware 678 MB -> 147 MB, but the initramfs came
out 97 MB and is now kernel-MODULE-bound, not firmware: --no-hostonly +
plymouth's drm dep instmods every GPU driver (amdgpu.ko etc.) though the fleet
is i915-only.

- omit_drivers += amdgpu radeon nouveau (90-diskless.conf): drop the discrete-GPU
  kmods (amdgpu.ko is the biggest single module in the initramfs); keep i915 +
  virtio-gpu/bochs for the splash. Shrinks the initramfs/UKI pulled over PXE on
  every boot.
- Firmware keep-list tightened: drop mellanox/ (mlxsw_spectrum SWITCH-ASIC blobs,
  not NIC fw — mlx5 NIC fw is on-card) and narrow intel/ to just ice (drop
  ish/sof/ibt sensor-hub/audio/bluetooth, none loaded at boot per the audit).
- Add an 'initramfs largest files' diagnostic (sort lsinitrd.txt by size) so the
  next build shows what dominates the .img.

BENCH-VERIFY: kiosk still renders on the 820 (i915 kept); watch the new initramfs
largest-files log line for the post-omit size.

docs/TODO.md

@@ -1504,11 +1504,31 @@ load — the one real risk); (b) if any host has a non-Intel GPU or an `ice`/`ml
 widen the keep-list before trusting fleet-wide. Audited models so far: HP-820-class
 (i915 + e1000e + iwlwifi-dropped) and virtio VMs.
 
+**Build-verified 2026-07-03:** firmware **678 MB → 147 MB**; the initramfs diagnostic
+confirms only the keep-list is bundled (i915 all-gens + intel/ice + intel/ish + mellanox)
+— proving the pre-dracut ordering works. But the initramfs came out **97 MB**, and it's
+now **kernel-MODULE-bound, not firmware** (~10 MB fw): the `--no-hostonly` + plymouth
+`drm` set pulls every GPU driver (`amdgpu.ko` etc.) even though the fleet is i915-only.
+
+**[x] DONE — follow-on trims (2026-07-03):**
+- **`omit_drivers+=" amdgpu radeon nouveau "`** in `90-diskless.conf` — drops the
+  discrete-GPU kmods plymouth's `drm` dep would instmod (amdgpu.ko is the biggest single
+  module); keeps i915 + virtio-gpu/bochs for the splash. Targets the 97 MB initramfs/UKI.
+- **Firmware keep-list tightened**: dropped `mellanox/` (those are `mlxsw_spectrum`
+  SWITCH-ASIC blobs, NOT NIC fw — mlx5 NIC fw is on-card) and narrowed `intel/` to just
+  `ice` (dropped ish/sof/ibt = sensor-hub/audio/bluetooth, none loaded at boot).
+- **Initramfs top-25-files diagnostic** added after the dracut build (sorts `lsinitrd.txt`
+  by size) so the next build shows what dominates the `.img` — measure before the next cut.
+- **BENCH-VERIFY:** kiosk still renders on the 820 (i915 kept); check the new
+  "initramfs largest files" log line for the post-omit size + next targets.
+
 **Combined:** ~**800 MB** off the uncompressed erofs (langpacks + firmware), dwarfing the
-kiosk weak-deps trim (#4). NEXT candidates from the manifest (measure, don't guess):
-`iso-codes` (19 MB), `samba-client-libs`/`intel-mediasdk`/`gstreamer` (chromium-common
-HARD deps — only removable by dropping HTML5 media), `binutils` (25 MB, build-only?),
-`cracklib-dicts` (9.8 MB, needed for pam pwquality — keep).
+kiosk weak-deps trim (#4), plus a smaller UKI/initramfs from the DRM-driver omit. NEXT
+candidates from the manifest (measure, don't guess): `iso-codes` (19 MB),
+`samba-client-libs`/`intel-mediasdk`/`gstreamer` (chromium-common HARD deps — only
+removable by dropping HTML5 media, and samba/rabbitmq/rist/srt/zmq are libavformat
+DT_NEEDED so they can't go without breaking future media — confirmed via ldd 2026-07-03),
+`binutils` (25 MB, build-only?), `cracklib-dicts` (9.8 MB, needed for pam pwquality — keep).
 
 **Stack note:** committed on `trim-rpm`. When `optimise-ram` rebases onto the new
 `trim-rpm`, expect a trivial `docs/TODO.md` tail conflict (both branches appended after