trim: slim image ~800 MB — glibc langpacks en-only + linux-firmware strip (TODO #18)

The 2b rpm-size manifest revealed the biggest packages aren't the kiosk but
base bloat: linux-firmware 678 MB and glibc-all-langpacks 228 MB (vs chromium
370 + llvm 129). The uncompressed erofs is read over NVMe/TCP on every boot,
so this is fleet-wide dead weight + attack surface.

glibc: swap glibc-all-langpacks (every language) for glibc-minimal-langpack +
glibc-langpack-en. ~220 MB; image is English-only.

linux-firmware: a live fleet audit (modinfo -F firmware over loaded modules +
sysfs/lspci driver bindings on the real 820-class hosts and the VMs) proved the
only firmware any host loads is Intel i915 (GPU). Every NIC is firmware-free
(e1000e reports on-chip NVM, not a fw file; virtio_net loads nothing), so the
catastrophic missing-NIC-firmware case is off the table. Keep i915 + intel/
(ice DDP insurance) + mellanox + intel-ucode; strip the ~600 MB of foreign
vendor blobs (amdgpu/nvidia/radeon/ath/qcom/...). Remove iwl*-firmware (Wi-Fi,
~83 MB) on a wired-only fleet. Strip-in-place since the package can't be
removed without losing i915; du reports the result in the build log.

BENCH-VERIFY: kiosk still renders on the 820 (i915 DMC/GuC load) — the one real
risk; widen the keep-list if any host has a non-Intel GPU or an ice/mlx5 NIC.

docs/TODO.md

@@ -1469,3 +1469,42 @@ connection to `:4420` established in the initramfs BEFORE firewalld starts. Veri
 default → should, but UNVERIFIED); a reconnect within `ctrl_loss_tmo` re-establishes
 *through* the firewall; DHCP renew + MKA keepalives unaffected; SSH in; no AVCs; verity
 hash reproducible. If it drops the root, that is the fleet-wide outage risk — gate hard.
+
+## [~] 18. Slim the image — locale + firmware (biggest erofs-size wins)
+
+**Finding (image-size audit via the 2b `rpm -qa --qf '%{SIZE}'` manifest, 2026-07-03):**
+the largest packages in the 534-package image are NOT the kiosk — they're base bloat:
+`linux-firmware` **678 MB**, `glibc-all-langpacks` **228 MB**, then chromium (370) +
+llvm-libs (129). The uncompressed erofs is read over NVMe/TCP on every boot of every
+host, so every dead byte is fleet-wide waste + attack surface.
+
+**[x] DONE — glibc langpacks → en-only** (`diskless.pkr.hcl` step 2). `@^minimal-environment`
+pulls `glibc-all-langpacks` (all languages); swapped for `glibc-minimal-langpack` +
+`glibc-langpack-en`. ~220 MB reclaimed; image is English-only (we also strip
+`/usr/share/locale` in 2d). **BENCH-VERIFY:** locale still `en_US.UTF-8`; kiosk + login OK.
+
+**[x] DONE — linux-firmware strip to a hardware-audited keep-list** (`diskless.pkr.hcl` 2d).
+Live fleet audit (`modinfo -F firmware` over all loaded modules + sysfs/`lspci` driver
+bindings on the real 820-class hosts AND the VMs) proved the **only** loadable firmware
+any host requests is Intel **i915** (GPU). Every other driver is firmware-free —
+crucially **e1000e** (on-chip NVM, not a fw file) and **virtio_net**, so NO NIC needs
+firmware and the fleet-brick case is off the table. Keep-list: `i915` + `intel/` (ice
+DDP insurance for the `ice`/`mlx5` server-NIC build variant + small Intel blobs) +
+`mellanox` + `intel-ucode`; strip the rest (amdgpu/nvidia/radeon/ath/qcom/rtl/iwlwifi…
+~600 MB). Wi-Fi (`iwl*-firmware`, ~83 MB) removed as packages (wired-only fleet).
+Strip-in-place (`find … -exec rm -rf`, not `rpm -e` — can't drop the package without
+losing i915); a `du -sh /usr/lib/firmware` line reports the result in the build log.
+**BENCH-VERIFY:** (a) kiosk still RENDERS on the 820 after the strip (i915 DMC/GuC still
+load — the one real risk); (b) if any host has a non-Intel GPU or an `ice`/`mlx5` NIC,
+widen the keep-list before trusting fleet-wide. Audited models so far: HP-820-class
+(i915 + e1000e + iwlwifi-dropped) and virtio VMs.
+
+**Combined:** ~**800 MB** off the uncompressed erofs (langpacks + firmware), dwarfing the
+kiosk weak-deps trim (#4). NEXT candidates from the manifest (measure, don't guess):
+`iso-codes` (19 MB), `samba-client-libs`/`intel-mediasdk`/`gstreamer` (chromium-common
+HARD deps — only removable by dropping HTML5 media), `binutils` (25 MB, build-only?),
+`cracklib-dicts` (9.8 MB, needed for pam pwquality — keep).
+
+**Stack note:** committed on `trim-rpm`. When `optimise-ram` rebases onto the new
+`trim-rpm`, expect a trivial `docs/TODO.md` tail conflict (both branches appended after
+#16 — `optimise-ram` added #17 fapolicyd, this added #18); resolve by keeping both.