fix(rhel): address several RHEL/Rocky 10 post-install issues

* Replace in-place edit of /etc/systemd/logind.conf with a drop-in under
  /etc/systemd/logind.conf.d/. Recent systemd versions (RHEL/Rocky 10,
  Fedora 39+) moved logind.conf to /usr/lib/systemd/ and no longer ship
  it under /etc/, so the previous sed call failed with "No such file or
  directory".
* Locate grub.cfg by probing the well-known UEFI vendor and BIOS paths
  directly instead of keying off the installer's /sys/firmware/efi and
  running find. On RHEL/Rocky 10 UEFI installs this was silently
  skipping the grub2-mkconfig regeneration, leaving the console
  ordering change in /etc/default/grub unapplied.
* Drop the dead "yum erase authconfig" call. authconfig has not existed
  since RHEL 8 (replaced by authselect), so the call was a no-op on
  every supported target.

Author: markuslf

CHANGELOG.md

@@ -10,7 +10,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+* `lf-rhel.cfg`: Fix `grub2-mkconfig` being silently skipped on RHEL/Rocky 10 UEFI installs. The previous check keyed off the installer's `/sys/firmware/efi` and only looked at one path; it now probes the well-known UEFI vendor directories and the BIOS path directly, so the console-ordering change in `/etc/default/grub` is actually reflected in the generated `grub.cfg`
 * `lf-rhel.cfg`: Fix post-install failure on RHEL 10 / Rocky 10 cloud installs. The previous `%post --nochroot` block copied `dynamic.ks` and `70-install-ssh-keys.ks` into `/root` of the installed system for auditing and kept breaking across Anaconda versions (first `/proc/mounts` parsing, then mount-point layout). The archival is now performed by a chrooted `%post` hook generated in `%pre` under `/usr/share/anaconda/post-scripts/`, with the content embedded via base64-decoded heredoc. The same kickstart now works on RHEL/Rocky 8, 9 and 10
+* `lf-rhel.cfg`: Fix `sed: can't read /etc/systemd/logind.conf` on RHEL/Rocky 10 cloud installs. Recent systemd versions no longer ship `logind.conf` under `/etc/`; the `NAutoVTs=0` override is now applied via a drop-in at `/etc/systemd/logind.conf.d/10-lf-no-auto-vts.conf`, which works on all supported systemd versions
+
+### Removed
+
+* `lf-rhel.cfg`: Drop the dead `yum erase authconfig` call from the cloud post-install script. `authconfig` has not existed since RHEL 8 (replaced by `authselect`), so the call was a no-op on every supported target
 
 
 ## [1.2.0] - 2026-04-15

lf-rhel.cfg

@@ -256,11 +256,6 @@ echo "Removing firewalld"
 # yum -C -y remove "firewalld*" --setopt="clean_requirements_on_remove=1"
 yum --cacheonly -y erase "firewalld*"
 
-# Another one needed at install time but not after that, and it pulls
-# in some unneeded deps (like, newt and slang)
-echo "Removing authconfig"
-yum --cacheonly -y erase authconfig
-
 echo "Removing avahi"
 yum --cacheonly -y remove avahi\\*
 
@@ -278,10 +273,18 @@ systemctl enable cloud-final
 systemctl enable rngd
 
 echo "Getty fixes"
-# although we want console output going to the serial console, we don't
-# actually have the opportunity to login there. FIX.
-# we don't really need to auto-spawn _any_ gettys.
-sed --in-place 's/^#NAutoVTs=.*/NAutoVTs=0/' /etc/systemd/logind.conf
+# We don't need autospawned gettys on cloud/virtual instances: although we
+# route console output to the serial console, we don't actually have the
+# opportunity to log in there. Use a logind drop-in instead of editing
+# /etc/systemd/logind.conf in place, because recent systemd versions
+# (shipped with RHEL/Rocky 10 and Fedora 39+) moved the stock logind.conf
+# to /usr/lib/systemd/ and no longer ship it under /etc/. Drop-ins in
+# /etc/systemd/logind.conf.d/ work on all supported systemd versions.
+mkdir -p /etc/systemd/logind.conf.d
+cat > /etc/systemd/logind.conf.d/10-lf-no-auto-vts.conf << EOF
+[Login]
+NAutoVTs=0
+EOF
 
 echo "Network fixes"
 # initscripts don't like this file to be missing.
@@ -341,15 +344,22 @@ echo 'Adjust console output in /etc/default/grub and regenerate grub config'
 # If init script messages need to be seen on the serial console as well, it should be made
 # the primary by swapping the order of the console parameters:
 sed --in-place 's/console=ttyS0,115200n8 console=tty0/console=tty0 console=ttyS0,115200n8/' /etc/default/grub
-if [ -d /sys/firmware/efi/ ]; then
-    grub_config_file=$(find /boot/efi -name grub.cfg)
-else
-    grub_config_file=$(find /boot/ -name grub.cfg)
-fi
+# Locate grub.cfg by checking well-known locations directly. The previous
+# approach keyed off the installer's /sys/firmware/efi and called find, which
+# missed the UEFI grub.cfg on RHEL/Rocky 10 installs and silently skipped the
+# grub2-mkconfig regeneration. Check the UEFI vendor directories first, then
+# the BIOS location.
+grub_config_file=
+for candidate in /boot/efi/EFI/*/grub.cfg /boot/grub2/grub.cfg; do
+    if [ -f "$candidate" ]; then
+        grub_config_file="$candidate"
+        break
+    fi
+done
 if [ -z "$grub_config_file" ]; then
     echo 'Could not find a grub.cfg in /boot. Skipping grub2-mkconfig'
 else
-    grub2-mkconfig --output=$grub_config_file
+    grub2-mkconfig --output="$grub_config_file"
 fi
 
 echo "Removing random-seed so it's not the same in every image"