Build the Apple initramfs drop-ins on the HOOKS baseline, Apple only

[maralcbr]

Ticket 16 of the Apple Silicon convergence plan, against quattro-upstream (which now carries #527's boot package source, the composable HOOKS baseline #536, the runtime settings profile #542 and the image-target detector #546).

omarchy-mac-boot's mkinitcpio drop-ins now build on the baseline in 00-omarchy-hooks.conf and act only on Apple Silicon:

• 90- (asahi, omarchy-vendorfw), 91- (omarchy-mac-encrypt, sd-encrypt), 92- (HID and Thunderbolt modules) and 94- (sd-vconsole guard for non-Latin layouts) change nothing unless omarchy-hw-platform says apple-silicon or HOOKS already carry asahi. asahi is the same marker the baseline uses for a Mac's own line, including off a Mac such as in a VM.
• A failing detector stops the build, as the baseline does. A missing detector keeps the Apple behaviour: the package only installs on Macs, and a runtime older than the detector must not lose the unlock hooks on its next rebuild.
• 93-omarchy-mac-plymouth.conf and its ALPM trigger are gone: the Apple baseline already has plymouth after systemd.
• 94- no longer adds /etc/vconsole.conf to FILES. omarchy_hooks.conf bundles it for Latin layouts (it was listed twice on the baseline), and sd-vconsole bundles it itself.
• Gap-audit row D5: fix-asahi-hid-race.sh, and migration 1788200001 which sources it, write no apple_hid_modules.conf when 92- is installed, so the HID modules have one writer. Macs that already have the file keep it; the duplicate entries are harmless.

Testing

• New test/shell.d/mac-initramfs-compose-test.sh composes omarchy-settings' and omarchy-mac-boot's drop-ins the way mkinitcpio does, on detector fixtures:
  • Apple Silicon gets exactly the HOOKS mx-mac builds today, the same module set and vconsole.conf once: base systemd plymouth autodetect microcode modconf kms keyboard sd-vconsole block asahi omarchy-vendorfw omarchy-mac-encrypt sd-encrypt filesystems fsck. The mx-mac values were read on the M2 Max (omarchy-mac-boot 20260921-10, mkinitcpio 42). Land #503 with the review fixes and the gap-audit merge blockers #527's drop-ins fail this test, because vconsole.conf is bundled twice.
  • On Qualcomm, generic aarch64 and x86, HOOKS, MODULES and FILES are identical with and without omarchy-mac-boot's drop-ins, for Latin and non-Latin layouts.
  • Also covered: non-Latin layouts on Apple, a legacy cryptdevice= Mac's busybox line (kept) and an asahi root off a Mac (keeps its unlock hooks).
• Boot package tests gain off-Apple, failing-detector and missing-detector cases for every drop-in. Each of these mutations fails a test: removing a gate, dropping the return 1, treating a missing detector as non-Apple, or removing the asahi marker.
• Real images: mkinitcpio 42 in an Arch Linux ARM container, with a fake 7.1.12 Aurora module tree and the M2 Max's mkinitcpio.conf, vconsole.conf and asahi hook.
  • Compared mx-mac's own drop-ins with the converged set (baseline, omarchy_hooks.conf, thunderbolt_module.conf, these drop-ins, with and without apple_hid_modules.conf). Same build hooks, and the same files byte for byte apart from /config and modules-load.d/MODULES.conf, which list the same modules with different duplicates.
  • Qualcomm and generic aarch64 images are identical with and without omarchy-mac-boot's drop-ins, apart from /buildconfig.
• packages/omarchy-mac/boot/test/all standalone as a non-root user in an Arch Linux ARM container: all pass. The real-image sections of the HID and vconsole tests pass. They now install the detector stand-in in /usr/bin, because mkinitcpio runs with PATH=/usr/bin:/bin.
• Runtime suite (test/all, non-root, Arch Linux ARM container): 325 of 332 files pass. The 7 failures are config-test, hermes-remove, hw-hybrid-gpu, legacy-power-udev-rules-migration, platform-packages, snapper and unowned-system-paths. All of them also fail on the base branches in the same container.
• Not run: VM acceptance of an encrypted Apple image (ticket criterion). It needs a candidate image built from quattro-upstream.

Second review: the first round found that a runtime without the detector would lose the Apple hooks, and that a failing detector read as "not a Mac"; both are fixed. The second round found no regression on Apple or elsewhere. Its remaining findings: two test gaps (fixed), and the packaging dependency below.

Follow-ups

• Do not publish omarchy-mac-boot from this commit yet. With 93- gone, Plymouth at the prompt comes only from omarchy-settings' 00-omarchy-hooks.conf, and vconsole.conf on a legacy busybox line only from its omarchy_hooks.conf. So omarchy-mac-boot's next re-pin adds a dependency on omarchy-mkinitcpio-hooks-baseline (omarchy-mac-boot 20260925-3: re-pin to quattro-upstream f7ea7ecc omarchy-pkgs#641), and no published omarchy-settings provides that yet. This change must not reach a published omarchy-mac-boot until an omarchy-settings package providing it is on edge for aarch64.
• thunderbolt? in a systemd initramfs (Runtime settings profile and platform package lists #542). mkinitcpio's systemd hook writes MODULES verbatim to /etc/modules-load.d/MODULES.conf, so settings' MODULES+=(thunderbolt?) adds a thunderbolt? line that systemd-modules-load cannot resolve. On Macs the module is loaded anyway through 92-, but the initrd's modules-load unit can log a failure. This is outside this ticket; it affects any systemd HOOKS line.