trim: slim image ~800 MB — glibc langpacks en-only + linux-firmware strip (TODO #18)

The 2b rpm-size manifest revealed the biggest packages aren't the kiosk but
base bloat: linux-firmware 678 MB and glibc-all-langpacks 228 MB (vs chromium
370 + llvm 129). The uncompressed erofs is read over NVMe/TCP on every boot,
so this is fleet-wide dead weight + attack surface.

glibc: swap glibc-all-langpacks (every language) for glibc-minimal-langpack +
glibc-langpack-en. ~220 MB; image is English-only.

linux-firmware: a live fleet audit (modinfo -F firmware over loaded modules +
sysfs/lspci driver bindings on the real 820-class hosts and the VMs) proved the
only firmware any host loads is Intel i915 (GPU). Every NIC is firmware-free
(e1000e reports on-chip NVM, not a fw file; virtio_net loads nothing), so the
catastrophic missing-NIC-firmware case is off the table. Keep i915 + intel/
(ice DDP insurance) + mellanox + intel-ucode; strip the ~600 MB of foreign
vendor blobs (amdgpu/nvidia/radeon/ath/qcom/...). Remove iwl*-firmware (Wi-Fi,
~83 MB) on a wired-only fleet. Strip-in-place since the package can't be
removed without losing i915; du reports the result in the build log.

BENCH-VERIFY: kiosk still renders on the 820 (i915 DMC/GuC load) — the one real
risk; widen the keep-list if any host has a non-Intel GPU or an ice/mlx5 NIC.

diskless.pkr.hcl

@@ -296,6 +296,16 @@ build {
       # talks to the TPM directly via go-tpm. So this list stays at the baseline.)
       "dnf -y install wpa_supplicant tpm2-tools tpm2-tss nvme-cli cryptsetup dracut-network NetworkManager zstd openssl",
 
+      # Locale trim: @^minimal-environment pulls glibc-all-langpacks — ~228 MB of
+      # locale data for EVERY language (measured 2026-07-03, 3rd-largest package in
+      # the whole image). This fleet is English-only (we also strip
+      # /usr/share/locale in 2d). Swap it for the English langpack + the C/POSIX
+      # minimal set → reclaims ~220 MB of the read-only erofs. Install the small
+      # replacements first, then drop the monolith (nothing Requires it; strict so
+      # a surprise dep surfaces in CI rather than silently bloating the image).
+      "dnf -y install glibc-minimal-langpack glibc-langpack-en",
+      "dnf -y remove glibc-all-langpacks",
+
       # EFI / Secure Boot management tools (efivar, mokutil, efibootmgr — all base
       # repos). Used over SSH on a workstation: `mokutil --sb-state/--pk/--kek/--db`
       # reads Secure Boot state + the enrolled PK/KEK/db; efibootmgr manages boot
@@ -914,6 +924,30 @@ build {
       "if [ -d /usr/lib64/chromium-browser/locales ]; then find /usr/lib64/chromium-browser/locales -type f -name '*.pak' ! -name 'en-US.pak' -delete; fi",
       # App translation catalogs (.mo) for locales this fleet never uses.
       "[ -d /usr/share/locale ] && find /usr/share/locale -mindepth 1 -maxdepth 1 -type d ! -name 'en*' ! -name 'C*' -exec rm -rf {} + || true",
+      # Firmware slimming (biggest single win — see docs/TODO #18). linux-firmware
+      # ships ~678 MB of blobs for thousands of devices this fixed-hardware fleet
+      # will never have (amdgpu/nvidia/radeon/ath/qcom/rtl/…). A live fleet audit
+      # (2026-07-03, `modinfo -F firmware` across all loaded modules + `lspci`/sysfs
+      # driver bindings on the real 820-class hosts and the VMs) proved the ONLY
+      # loadable firmware ANY host requests is Intel **i915** (GPU). Every other
+      # driver is firmware-free: NICs are e1000e / virtio_net (e1000e's ethtool
+      # "firmware-version" is on-chip NVM, not a /usr/lib/firmware file), storage
+      # ahci, USB xhci, audio snd_hda_intel — none call request_firmware(). So NO
+      # NIC needs firmware, which removes the catastrophic case. KEEP: i915 (GPU,
+      # all Intel gens for mixed models) + intel/ (ice DDP insurance for the
+      # ice/mlx5 server-NIC build variant + small Intel blobs) + mellanox +
+      # intel-ucode; STRIP the rest (~600 MB off the uncompressed erofs). Risk
+      # asymmetry: missing NIC fw would brick the fleet (none needed) but missing
+      # GPU fw only degrades a display. BENCH-VERIFY the kiosk still renders on the
+      # 820 (i915 DMC/GuC load) after this; widen the keep-list if a future host
+      # has a non-Intel GPU or an ice/mlx5 NIC. Strip-in-place (rm, not rpm -e):
+      # linux-firmware can't be removed as a package without also losing i915.
+      "if [ -d /usr/lib/firmware ]; then find /usr/lib/firmware -mindepth 1 -maxdepth 1 ! -name i915 ! -name intel ! -name mellanox ! -name intel-ucode -exec rm -rf {} + ; fi",
+      # Wi-Fi firmware: wired-only fleet (no iwlwifi). Remove the packages cleanly
+      # so the rpmdb stays honest (the find above already dropped their top-level
+      # iwlwifi-*.ucode files). Glob quoted so the shell doesn't expand it.
+      "dnf remove -y 'iwl*-firmware' 2>/dev/null || true",
+      "echo \"==> firmware after strip: $(du -sh /usr/lib/firmware 2>/dev/null | cut -f1) (was ~678 MB)\"",
     ]
   }