trim: omit unused GPU drivers + tighten firmware keep-list (TODO #18)

First trim build confirmed firmware 678 MB -> 147 MB, but the initramfs came
out 97 MB and is now kernel-MODULE-bound, not firmware: --no-hostonly +
plymouth's drm dep instmods every GPU driver (amdgpu.ko etc.) though the fleet
is i915-only.

- omit_drivers += amdgpu radeon nouveau (90-diskless.conf): drop the discrete-GPU
  kmods (amdgpu.ko is the biggest single module in the initramfs); keep i915 +
  virtio-gpu/bochs for the splash. Shrinks the initramfs/UKI pulled over PXE on
  every boot.
- Firmware keep-list tightened: drop mellanox/ (mlxsw_spectrum SWITCH-ASIC blobs,
  not NIC fw — mlx5 NIC fw is on-card) and narrow intel/ to just ice (drop
  ish/sof/ibt sensor-hub/audio/bluetooth, none loaded at boot per the audit).
- Add an 'initramfs largest files' diagnostic (sort lsinitrd.txt by size) so the
  next build shows what dominates the .img.

BENCH-VERIFY: kiosk still renders on the 820 (i915 kept); watch the new initramfs
largest-files log line for the post-omit size.

files/etc/dracut.conf.d/90-diskless.conf

@@ -25,5 +25,13 @@ add_dracutmodules+=" dot1x-macsec network-manager nvmf systemd-veritysetup "
 add_dracutmodules+=" plymouth "
 filesystems+=" erofs overlay "
 add_drivers+=" macsec nvme-tcp nvme-fabrics dm-verity @NIC_DRIVERS@ "
+# Omit the discrete-GPU DRM drivers plymouth's `drm` dep would otherwise instmod
+# in --no-hostonly mode. This fleet is Intel i915 ONLY (the build VM uses
+# virtio-gpu/bochs), so amdgpu/radeon/nouveau are dead weight — amdgpu.ko alone is
+# the single biggest module in the initramfs. i915 + virtio-gpu/bochs stay for the
+# splash. (Their FIRMWARE is already stripped pre-dracut in diskless.pkr.hcl; this
+# drops the MODULES too.) If a future host has a non-Intel GPU, remove it here.
+# See docs/TODO #18.
+omit_drivers+=" amdgpu radeon nouveau "
 install_items+=" /etc/dot1x/radius-ca.pem /etc/dot1x/wpa_supplicant-dot1x.conf "
 compress="zstd"