kernel: the initramfs script takes over a default-config preset and checks each image (issue 1977, L7-L9)

Before mkinitcpio -P, a preset naming ALL_config="/etc/mkinitcpio.conf" is copied to the state's
taken-over/ and loses that line (another ALL_config is left and named); after it, an image without
kernel/x86/microcode/ in its first 64 KiB fails the unit and records nothing. The unit may write
/etc/mkinitcpio.d. The README names no node. Tests: 1977/AC7, 1977/AC8; AC3/AC4 fixtures write images.

Builds: L7, L8, L9 (issue 1977 note 4)

modules/kernel/README.md

@@ -56,7 +56,7 @@ built for the fallback kernel too) after its boot-entries service, so the entry
 ## Microcode in every initramfs (novox/hq issue 1977)
 
 Before this, `amd-ucode` was installed by hand on two machines and no initramfs carried it, so a machine booted from
-its default entry ran the CPU's older microcode (ace: revision 0x0a201016 while the package held 0x0a20102e). The module
+its default entry ran the CPU's older microcode (one machine: revision 0x0a201016 while the package held 0x0a20102e). The module
 declares the packages and makes mkinitcpio's own `microcode` hook part of every image, so every boot entry loads it,
 a default entry written by hand included, and no entry is edited. The fallback entry's own microcode lines stay (a second
 early archive is harmless).
@@ -65,8 +65,8 @@ early archive is harmless).
 |---|---|---|
 | packages | `amd-ucode`, `intel-ucode` | both on every machine; the `autodetect` hook keeps only the running CPU's microcode in the default image |
 | file | `/etc/mkinitcpio.conf.d/mesh-microcode.conf` | read by mkinitcpio after `mkinitcpio.conf`: appends `microcode` to `HOOKS` unless it names it |
-| file | `${dir:state}/initramfs` | the script, `apply`: when the drop-in differs from the one the images were last built with (`${dir:state}/initramfs-built`) it runs `mkinitcpio -P` and then records the drop-in; otherwise it says "as it was". A failed mkinitcpio fails the unit, says so and records nothing |
-| file | `/etc/systemd/system/mesh-kernel-initramfs.service` | oneshot, sandboxed: the file system read-only but for `/boot` and the module's state, a private `/tmp`, no home, no network |
+| file | `${dir:state}/initramfs` | the script, `apply`: when the drop-in differs from the one the images were last built with (`${dir:state}/initramfs-built`) it runs `mkinitcpio -P` and then records the drop-in; otherwise it says "as it was". Before building it takes a preset's `ALL_config="/etc/mkinitcpio.conf"` line out (that line makes mkinitcpio skip `mkinitcpio.conf.d`; a copy of the preset goes to `${dir:state}/taken-over/`; another `ALL_config` is left and named); after building, an image without `kernel/x86/microcode/` in its first 64 KiB fails the unit, which names it. A failed mkinitcpio fails the unit, says so and records nothing |
+| file | `/etc/systemd/system/mesh-kernel-initramfs.service` | oneshot, sandboxed: the file system read-only but for `/boot`, `/etc/mkinitcpio.d` and the module's state, a private `/tmp`, no home, no network |
 | service | `mesh-kernel-initramfs.service` | running and enabled; restarted when the unit, the script or the drop-in changes. Later kernel upgrades build their images through the distribution's own hook, with the drop-in in place |
 
 The module does not reboot: a machine loads the new microcode at its next boot. `kernel_boot` says the revision the CPU