feat(kernel): swap stock linux for linux-lts as fallback kernel

Promotes linux-hardened to the sole primary kernel and replaces
linux with linux-lts as the safety-net fallback. Rationale:

- linux and linux-hardened track the same upstream major version
  and ship within days of each other, so 'linux' was a poor
  fallback for the regression class that historically takes out
  the hardened kernel on this hardware (e.g. checkpoint 026
  wake-from-suspend panic). linux-lts lags by weeks/months and is
  almost always known-good when hardened breaks.
- Drop etc/mkinitcpio.d/linux.preset, add linux-lts.preset.
  Hardened preset header + bootstrap.sh efibootmgr instructions
  updated accordingly (hardened registered first so it's the
  default; lts registered as the on-demand fallback).
- Also add mkinitcpio-firmware (AUR) to silence the spurious
  'missing firmware' warnings during initramfs builds.

Manual host-side steps after deploy:
  paru -S linux-lts linux-lts-headers mkinitcpio-firmware
  sudo pacman -Rsn linux  # or via 'just pkg-apply' undeclared flow
  sudo rm -f /etc/mkinitcpio.d/linux.preset  # chezmoi-deployed, not pkg-owned
  sudo mkinitcpio -P
  sudo efibootmgr  # add the Arch LTS entries, drop the stock linux ones

Note: meta/nvidia.txt still lists 'linux-headers' for nvidia-dkms.
That's a per-host concern; flagged for follow-up if any nvidia host
moves to the linux-lts world.

1 files changed, 6 insertions, 6 deletions

diff --git a/bootstrap.sh b/bootstrap.sh
index afa4909..2f35f9d 100755
--- a/bootstrap.sh
+++ b/bootstrap.sh
@@ -125,20 +125,20 @@ if [ -d /sys/firmware/efi ]; then
   if ! sudo efibootmgr 2>/dev/null | grep -iq arch; then
     warn 'no Arch Linux EFI boot entry found'
     warn 'after first kernel install, run: sudo mkinitcpio -P'
-    warn 'then register the UKI with efibootmgr, for example:'
+    warn 'then register the UKIs with efibootmgr (hardened first so it'\''s the default):'
     # shellcheck disable=SC1003 # backslash is literal text shown to the user
     warn '  sudo efibootmgr --create --disk /dev/nvme0n1 --part 1 \'
-    warn "      --label 'Arch UKI' --loader '\\EFI\\Linux\\arch-linux.efi'"
+    warn "      --label 'Arch Hardened' --loader '\\EFI\\Linux\\arch-linux-hardened.efi'"
     # shellcheck disable=SC1003
     warn '  sudo efibootmgr --create --disk /dev/nvme0n1 --part 1 \'
-    warn "      --label 'Arch UKI Fallback' --loader '\\EFI\\Linux\\arch-linux-fallback.efi'"
-    warn 'optionally, also register the linux-hardened UKIs (opt-in boot):'
+    warn "      --label 'Arch Hardened Fallback' --loader '\\EFI\\Linux\\arch-linux-hardened-fallback.efi'"
+    warn 'and the linux-lts fallback kernel UKIs:'
     # shellcheck disable=SC1003
     warn '  sudo efibootmgr --create --disk /dev/nvme0n1 --part 1 \'
-    warn "      --label 'Arch Hardened' --loader '\\EFI\\Linux\\arch-linux-hardened.efi'"
+    warn "      --label 'Arch LTS' --loader '\\EFI\\Linux\\arch-linux-lts.efi'"
     # shellcheck disable=SC1003
     warn '  sudo efibootmgr --create --disk /dev/nvme0n1 --part 1 \'
-    warn "      --label 'Arch Hardened Fallback' --loader '\\EFI\\Linux\\arch-linux-hardened-fallback.efi'"
+    warn "      --label 'Arch LTS Fallback' --loader '\\EFI\\Linux\\arch-linux-lts-fallback.efi'"
   fi
 fi