Fix mkinitcpio hook detection: current default is systemd-based, not udev

Verified against the actual cached mkinitcpio package (41-4), not assumed:
its shipped /etc/mkinitcpio.conf template is
HOOKS=(base systemd autodetect microcode modconf kms keyboard sd-vconsole
block filesystems fsck) — there's no "udev" token at all on a stock
install anymore, systemd is the base hook instead.

This silently broke two things:
- The existing plymouth-hook insertion (`sed 's/\budev\b/\0 plymouth/'`)
  has been a no-op on every fresh install using a current mkinitcpio
  package — the boot splash was never actually getting wired into the
  initramfs, just failing quietly (the script's best-effort `|| echo WARN`
  pattern doesn't catch a sed that "succeeds" by matching nothing).
- My own new encrypt-hook insertion from the previous commit had the same
  flaw, and would have used the wrong hook regardless: `encrypt` is the
  udev-based hook, systemd-based initramfs needs `sd-encrypt` instead.

post-install.sh now detects which base hook (systemd or udev) is actually
in HOOKS once, and uses the matching hook name for both plymouth
(unaffected by the choice, just needed the right anchor to insert after)
and LUKS unlocking (encrypt vs sd-encrypt — genuinely different hooks).

Also: avoid a redundant pacman -Sy in release-iso.yml's signing step —
the job already synced repos earlier in the same container.

.forgejo/workflows/release-iso.yml

@@ -148,7 +148,7 @@ jobs:
           sha256sum "$ISO_NAME" > SHA256SUMS
           cat SHA256SUMS
 
-          pacman -Sy --noconfirm --needed gnupg
+          pacman -S --noconfirm --needed gnupg
           export GNUPGHOME=/tmp/gnupg-release
           mkdir -m 700 -p "$GNUPGHOME"
           echo "$GPG_PRIVATE_KEY" | gpg --batch --import

iso/airootfs/etc/calamares/post-install.sh

@@ -65,19 +65,43 @@ if [[ -f /etc/mkinitcpio.conf ]]; then
         sed -i 's/^\(HOOKS=.*\bautodetect\b\)/\1 microcode/' /etc/mkinitcpio.conf \
             || echo "WARN: adding microcode hook failed"
     fi
+
+    # Current mkinitcpio's own shipped default template (verified against the
+    # actual package, not assumed) uses the systemd-based hook set
+    # (`HOOKS=(base systemd autodetect ... sd-vconsole block filesystems
+    # fsck)`), NOT the classic udev-based one — there is no literal "udev"
+    # token to match against on a stock install. The two hook sets are
+    # mutually exclusive alternatives (systemd substitutes for udev as the
+    # base hook providing the init program), and each has its own
+    # counterpart for anything that hooks into device/root setup:
+    # plymouth is the same either way, but LUKS unlocking needs `encrypt`
+    # under udev and `sd-encrypt` under systemd. Detect which is in play
+    # once and use the matching hook, instead of assuming udev (which
+    # silently no-ops the sed on every current install — this was already
+    # true for the plymouth insertion below before this fix, just never
+    # surfaced because it fails quietly).
+    if grep -qE '^HOOKS=.*\bsystemd\b' /etc/mkinitcpio.conf; then
+        BASE_HOOK="systemd"
+        ENCRYPT_HOOK="sd-encrypt"
+    else
+        BASE_HOOK="udev"
+        ENCRYPT_HOOK="encrypt"
+    fi
+
     if command -v plymouth-set-default-theme &>/dev/null \
        && ! grep -qE '^HOOKS=.*\bplymouth\b' /etc/mkinitcpio.conf; then
-        sed -i 's/^\(HOOKS=.*\budev\b\)/\1 plymouth/' /etc/mkinitcpio.conf \
+        sed -i "s/^\(HOOKS=.*\b${BASE_HOOK}\b\)/\1 plymouth/" /etc/mkinitcpio.conf \
             || echo "WARN: adding plymouth hook failed"
     fi
-    # encrypt — only when root is actually LUKS-encrypted (ROOT_ENCRYPTED,
+    # encrypt/sd-encrypt — only when root is actually LUKS-encrypted
-    # detected above). Must sit after `block` (provides the device nodes the
+    # (ROOT_ENCRYPTED, detected above). Must sit after `block` (provides the
-    # encrypt hook opens) and before `filesystems` (mounts the now-unlocked
+    # device nodes it opens) and before `filesystems` (mounts the now-
-    # root) — both already present in stock mkinitcpio.conf's default HOOKS.
+    # unlocked root) — both already present in stock mkinitcpio.conf's
+    # default HOOKS regardless of which base hook is in use.
     if [[ "$ROOT_ENCRYPTED" == "1" ]] \
        && ! grep -qE '^HOOKS=.*\bencrypt\b' /etc/mkinitcpio.conf; then
-        sed -i 's/^\(HOOKS=.*\bblock\b\)/\1 encrypt/' /etc/mkinitcpio.conf \
+        sed -i "s/^\(HOOKS=.*\bblock\b\)/\1 ${ENCRYPT_HOOK}/" /etc/mkinitcpio.conf \
-            || echo "WARN: adding encrypt hook failed"
+            || echo "WARN: adding ${ENCRYPT_HOOK} hook failed"
     fi
 fi