kiosk: disable weak deps + add package-footprint audit

The kiosk dnf transaction was measured at 229 pkgs / 1.0 GB. Nearly all
of the non-core packages are Recommends: a locked-down single-URL kiosk
never uses flatpak + its ostree/bubblewrap sandbox runtime, tracker-miners
(a filesystem indexer — dead weight and a threat surface), the pipewire/
pulseaudio audio stack, or libproxy-webkitgtk4 -> webkit2gtk3-jsc (an 8.9M
second browser engine dragged into a Chromium kiosk for libproxy's PAC
runner).

Add --setopt=install_weak_deps=False to cut them, and an rpm -qa size
manifest to the build log so the next CI build reports the exact new
footprint (turning 'seems unnecessary' into data for the next trim round:
gstreamer/media codecs, or mesa-dri-drivers if the GPU path is abandoned).

The immovable floor is chromium + chromium-common + llvm-libs (mesa sw-GL)
+ gtk3/adwaita + libicu, all hard deps. BENCH-VERIFY the kiosk still
renders with weak deps off (watch for a missing font or libva).

diskless.pkr.hcl

@@ -459,7 +459,27 @@ build {
       # the heaviest items here and are likely unnecessary given weston
       # --use-pixman + chromium --disable-gpu — candidate to drop once the kiosk
       # is display-verified; see TODO #4.)
-      "dnf install -y --setopt=tsflags=nodocs weston chromium mesa-dri-drivers mesa-libEGL mesa-libgbm dejavu-sans-fonts",
+      #
+      # install_weak_deps=False: a locked-down single-URL kiosk needs none of the
+      # Recommends: this transaction otherwise drags in — flatpak + its ostree/
+      # bubblewrap sandbox runtime, tracker-miners (a filesystem indexer, both
+      # dead weight AND a threat surface), the pipewire/pulseaudio audio stack,
+      # and libproxy-webkitgtk4 → webkit2gtk3-jsc (a whole SECOND browser engine
+      # pulled into a Chromium kiosk just for libproxy's PAC runner). Measured:
+      # the default (weak-deps=on) transaction was 229 pkgs / 1.0 GB. The floor
+      # that survives is chromium + chromium-common + llvm-libs (mesa sw-GL) +
+      # gtk3/adwaita + libicu — all HARD deps. If a genuine runtime dep turns out
+      # to be a weak dep (e.g. a font, or libva for VA-API on the GPU path), add
+      # it to the explicit list below rather than re-enabling weak deps wholesale.
+      "dnf install -y --setopt=tsflags=nodocs --setopt=install_weak_deps=False weston chromium mesa-dri-drivers mesa-libEGL mesa-libgbm dejavu-sans-fonts",
+      # Footprint audit (surfaces in the CI build log): the installed set, largest
+      # first, + a total count. Turns 'seems unnecessary' into data for the next
+      # trim round (e.g. dropping gstreamer/media codecs if the SPA plays no HTML5
+      # media, or mesa-dri-drivers if the GPU path is abandoned). %%{...} is escaped
+      # for Packer's HCL2 template engine (a bare %%{ is parsed as a directive).
+      "echo '==> kiosk package footprint (installed size, largest 40 first):'",
+      "rpm -qa --qf '%%{SIZE}\\t%%{NAME}-%%{VERSION}-%%{RELEASE}\\n' | sort -rn | head -40",
+      "echo \"==> total packages installed after kiosk: $(rpm -qa | wc -l)\"",
       # Unprivileged, passwordless kiosk user. Groups: 'video' (KMS /dev/dri/card0
       # for weston) + 'input' (libinput) as a seat fallback; 'render'
       # (/dev/dri/renderD128) so Chromium's GPU process can do hardware raster on