Add cryptsetup, tpm2-tools and tpm2-tss to every encrypted dish so the
initrd can be rebuilt with TPM2 support. A guarded %pre stashes a
preseeded LUKS passphrase from the kickstart, and a guarded %post
enrolls PCR 7-bound auto-unlock via systemd-cryptenroll, switches
crypttab to tpm2-device=auto and regenerates the initrd. Without a
preseeded passphrase or a TPM device the enrollment is skipped and the
system keeps the regular passphrase prompt.
- Move recipe-generator/ to cook/ for cleaner structure
- Fix ksflatten-relative path conversion to handle all %include paths
- Fix validation exit code to only fail on actual errors
- All recipes now generate and flatten successfully via make all
Lukas Greve