Fix mkinitcpio hook detection: current default is systemd-based, not udev

Verified against the actual cached mkinitcpio package (41-4), not assumed:
its shipped /etc/mkinitcpio.conf template is
HOOKS=(base systemd autodetect microcode modconf kms keyboard sd-vconsole
block filesystems fsck) — there's no "udev" token at all on a stock
install anymore, systemd is the base hook instead.

This silently broke two things:
- The existing plymouth-hook insertion (`sed 's/\budev\b/\0 plymouth/'`)
  has been a no-op on every fresh install using a current mkinitcpio
  package — the boot splash was never actually getting wired into the
  initramfs, just failing quietly (the script's best-effort `|| echo WARN`
  pattern doesn't catch a sed that "succeeds" by matching nothing).
- My own new encrypt-hook insertion from the previous commit had the same
  flaw, and would have used the wrong hook regardless: `encrypt` is the
  udev-based hook, systemd-based initramfs needs `sd-encrypt` instead.

post-install.sh now detects which base hook (systemd or udev) is actually
in HOOKS once, and uses the matching hook name for both plymouth
(unaffected by the choice, just needed the right anchor to insert after)
and LUKS unlocking (encrypt vs sd-encrypt — genuinely different hooks).

Also: avoid a redundant pacman -Sy in release-iso.yml's signing step —
the job already synced repos earlier in the same container.

.forgejo/workflows/release-iso.yml

@@ -148,7 +148,7 @@ jobs:
           sha256sum "$ISO_NAME" > SHA256SUMS
           cat SHA256SUMS
 
-          pacman -Sy --noconfirm --needed gnupg
+          pacman -S --noconfirm --needed gnupg
           export GNUPGHOME=/tmp/gnupg-release
           mkdir -m 700 -p "$GNUPGHOME"
           echo "$GPG_PRIVATE_KEY" | gpg --batch --import