fix(rhel): render actual disk in comment and remove both ks copies on cloud

* The archived dynamic.ks carried a comment reading "# Only touch
  $lfdisk." because a Python string used a shell-style variable
  reference where a .format() substitution was needed. Now emits
  the actual target disk (e.g. "# Only touch vda.").
* Modern Anaconda writes both /root/anaconda-ks.cfg and
  /root/original-ks.cfg when a kickstart is used. The cloud
  post-install script removed only the former, leaving stale copies
  of the bootstrap kickstart on every cloud base image. Remove
  /root/original-ks.cfg too so the cloud base is clean.
* README: correct and sharpen the "Modifying this Kickstart" and
  "Tests" sections. The lfkeys, users_<lftype> and post_<lftype>
  descriptions now match the actual Python data structures and
  interpreter behavior, and the `ll /root` test is now explicit
  about which files to expect per lftype, including the new
  original-ks.cfg cleanup on cloud variants.

Author: markuslf

CHANGELOG.md

@@ -13,6 +13,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 * `lf-rhel.cfg`: Fix `grub2-mkconfig` being silently skipped on every target version. The `%pre` script was built via an unquoted heredoc (`cat << EOT`), which let bash eat every `"$var"` and `$(cmd)` reference embedded in the generated shell code before the Python helper was even written. As a result the grub finder always ran with empty variables and printed "Could not find a grub.cfg in /boot" — hiding the fact that `/etc/default/grub` edits had not been regenerated since the first release. The heredoc is now quoted (`cat << 'EOT'`), the finder targets `/boot/grub2/grub.cfg` directly (which is the right target on RHEL/Rocky 8/9/10 for both BIOS and UEFI — on 9+ UEFI the `/boot/efi/EFI/<vendor>/grub.cfg` is only a thin wrapper that `configfile`s `/boot/grub2/grub.cfg`), and the console-ordering change in `/etc/default/grub` is actually reflected in the generated `grub.cfg`
 * `lf-rhel.cfg`: Fix post-install failure on RHEL 10 / Rocky 10 cloud installs. The previous `%post --nochroot` block copied `dynamic.ks` and `70-install-ssh-keys.ks` into `/root` of the installed system for auditing and kept breaking across Anaconda versions (first `/proc/mounts` parsing, then mount-point layout). The archival is now performed by a chrooted `%post` hook generated in `%pre` under `/usr/share/anaconda/post-scripts/`, with the content embedded via base64-decoded heredoc. The same kickstart now works on RHEL/Rocky 8, 9 and 10
 * `lf-rhel.cfg`: Fix `sed: can't read /etc/systemd/logind.conf` on RHEL/Rocky 10 cloud installs. Recent systemd versions no longer ship `logind.conf` under `/etc/`; the `NAutoVTs=0` override is now applied via a drop-in at `/etc/systemd/logind.conf.d/10-lf-no-auto-vts.conf`, which works on all supported systemd versions
+* `lf-rhel.cfg`: The "Only touch" comment in the archived `dynamic.ks` now renders the actual target disk path (e.g. `# Only touch vda.`) instead of a literal `$lfdisk`. The Python code was using a shell-style variable reference inside a plain string where a Python format substitution was needed
+
+### Changed
+
+* `lf-rhel.cfg`: On `lftype=cloud` and `lftype=cloud-cis`, the post-install script now also removes `/root/original-ks.cfg` in addition to `/root/anaconda-ks.cfg`. Both files are written by modern Anaconda and both contain the raw bootstrap kickstart — removing both keeps the base image clean for cloud deployments
+* README: Correct and sharpen the "Modifying this Kickstart" and "Tests" sections. The `lfkeys`, `users_<lftype>` and `post_<lftype>` descriptions now match the actual Python data structures and interpreter behavior, and the `ll /root` test is now explicit about which files to expect per `lftype`
 
 ### Removed
 

README.md

@@ -112,11 +112,11 @@ At the beginning of the pre-script the available Python version is determined, t
 The Python script then generates the `/tmp/dynamic.ks`.
 This Python script can be modified as follows:
 
-* `lfkeys`: An array of SSH keys that will be installed for either the `root` or `linuxfabrik` user depending on `lftype` as documented above.
+* `lfkeys`: An array of SSH public keys that will be authorized for the `linuxfabrik` user on `lftype=cis` and `lftype=minimal`. On `lftype=cloud` and `lftype=cloud-cis` no keys are deployed at install time, because `cloud-init` handles SSH key injection there. The `root` account never receives SSH keys regardless of `lftype`.
 * `packages_<lftype>`: An array with package names for a `<lftype>` install.
 * `part_<lftype>`: An array of kickstart `logvol` lines that define logical volumes for `<lftype>` as documented in Fedora Kickstart Syntax Reference: [logvol](https://docs.fedoraproject.org/en-US/fedora/f36/install-guide/appendixes/Kickstart_Syntax_Reference/#sect-kickstart-commands-logvol)
-* `users_<lftype>`: A string containing a ":" separated list in the form `name="<username>":cmd="<kickstart command used for user creation>":keys="<array of ssh-keys to add>"` (Fedora Kickstart Syntax Reference: [user](https://docs.fedoraproject.org/en-US/fedora/f36/install-guide/appendixes/Kickstart_Syntax_Reference/#sect-kickstart-commands-user), [rootpw](https://docs.fedoraproject.org/en-US/fedora/f36/install-guide/appendixes/Kickstart_Syntax_Reference/#sect-kickstart-commands-rootpw))
-* `post_<lftype>`: A multiline string containing the postscript for `<lftype>`. Will be executed by `/bin/sh`.
+* `users_<lftype>`: A Python list of dicts, one entry per user, with the keys `name` (the username), `cmd` (the kickstart command used to create the user, e.g. `user --name=linuxfabrik --groups=wheel --password=password --plaintext` or `rootpw --lock`) and `keys` (a list of SSH public keys to authorize for that user). See Fedora Kickstart Syntax Reference: [user](https://docs.fedoraproject.org/en-US/fedora/f36/install-guide/appendixes/Kickstart_Syntax_Reference/#sect-kickstart-commands-user), [rootpw](https://docs.fedoraproject.org/en-US/fedora/f36/install-guide/appendixes/Kickstart_Syntax_Reference/#sect-kickstart-commands-rootpw).
+* `post_<lftype>`: A multiline string containing the chrooted post-install script for `<lftype>`. Anaconda executes it with `/bin/sh`, which on every supported target (RHEL/Rocky 8/9/10, Fedora 38+) is bash invoked in sh-compat mode, so bash features like globs inside `[ -f "$var" ]` loops work as expected.
 
 
 ### Known Limitations
@@ -147,7 +147,7 @@ What to test within the VM:
 * `sudo dnf -y install nano`: Should work.
 * `systemctl status cloud-init`: Not found on non-cloud, should work on cloud.
 * `systemctl status firewalld`: Should be inactive on non-cloud. On cloud, firewalld is removed.
-* `ll /root`: Should list at least two Anaconda files.
+* `ll /root`: On `lftype=cis` and `lftype=minimal`, should list `anaconda-ks.cfg` and `original-ks.cfg` (both written by Anaconda), `dynamic.ks` (the rendered kickstart fragment Linuxfabrik applied) and `70-install-ssh-keys.ks` (the SSH key deployment fragment). On `lftype=cloud` and `lftype=cloud-cis`, should list only `dynamic.ks` — both of Anaconda's kickstart copies (`anaconda-ks.cfg` and `original-ks.cfg`) are removed by the cloud post-install script, and no SSH key fragment is generated because `cloud-init` handles keys.
 
 
 ### Troubleshooting

lf-rhel.cfg

@@ -383,6 +383,7 @@ truncate --size=0 /etc/machine-id
 echo 'Remove various other log / cache files'
 rm -f /root/.wget-hsts
 rm -f /root/anaconda-ks.cfg
+rm -f /root/original-ks.cfg
 rm -f /root/install.log
 rm -f /root/install.log.syslog
 rm -rf /var/lib/yum/*
@@ -473,7 +474,7 @@ for user in users:
 # `pykickstart` (used by `sshkey`) warns about multiple entries for the same user. Putting it in
 # %post avoids those warnings and makes the intent clearer to future maintainers.
 
-dynamic.append('# Only touch $lfdisk. This setting is also respected by zerombr (confirmed on RHEL8 and 9)')
+dynamic.append('# Only touch {}. This setting is also respected by zerombr (confirmed on RHEL8 and 9)'.format(lfdisk))
 dynamic.append('ignoredisk --only-use={}'.format(lfdisk))
 
 dynamic.append('# System bootloader configuration')