fix(archsetup): prevent ZFS boot failures and add validation tests

- Skip udev→systemd hook change on ZFS systems (ZFS hook is busybox-based)
- Add nvme to MODULES for NVMe systems (ensures devices ready for ZFS import)
- Add random.trust_cpu=off to suppress AMD RDSEED warnings
- Add has_nvme_drives() detection function

New validation tests:
- validate_terminus_font: check package installed via pacman
- validate_mkinitcpio_hooks: verify ZFS uses udev not systemd
- validate_initramfs_consolefont: check font in initramfs
- validate_nvme_module: check nvme in MODULES for NVMe systems

1 files changed, 69 insertions, 0 deletions

diff --git a/scripts/testing/lib/validation.sh b/scripts/testing/lib/validation.sh
index a2e375c..280f435 100644
--- a/scripts/testing/lib/validation.sh
+++ b/scripts/testing/lib/validation.sh
@@ -294,6 +294,12 @@ run_all_validations() {
     validate_boot_config
     validate_autologin_config
 
+    # Boot & Initramfs (critical for ZFS systems)
+    validate_terminus_font
+    validate_mkinitcpio_hooks
+    validate_initramfs_consolefont
+    validate_nvme_module
+
     # Archsetup Specific
     validate_archsetup_log
     validate_state_markers
@@ -764,6 +770,69 @@ validate_boot_config() {
     fi
 }
 
+validate_terminus_font() {
+    step "Checking terminus-font installation"
+    if ssh_cmd "pacman -Q terminus-font" &>> "$LOGFILE"; then
+        validation_pass "terminus-font package installed"
+    else
+        validation_fail "terminus-font package not installed"
+        attribute_issue "terminus-font not installed via pacman" "archsetup"
+    fi
+}
+
+validate_mkinitcpio_hooks() {
+    step "Checking mkinitcpio HOOKS configuration"
+    local hooks=$(ssh_cmd "grep '^HOOKS=' /etc/mkinitcpio.conf")
+    local is_zfs=$(ssh_cmd "findmnt -n -o FSTYPE / 2>/dev/null")
+
+    if [ "$is_zfs" = "zfs" ]; then
+        # ZFS system: must use udev, not systemd
+        if echo "$hooks" | grep -q '\budev\b'; then
+            validation_pass "ZFS system uses udev hook (correct)"
+        elif echo "$hooks" | grep -q '\bsystemd\b'; then
+            validation_fail "ZFS system uses systemd hook (will break boot)"
+            attribute_issue "mkinitcpio uses systemd hook on ZFS system" "archsetup"
+        else
+            validation_warn "Could not determine init hook type"
+        fi
+    else
+        # Non-ZFS: systemd hook is fine
+        if echo "$hooks" | grep -q '\bsystemd\b'; then
+            validation_pass "Non-ZFS system uses systemd hook"
+        elif echo "$hooks" | grep -q '\budev\b'; then
+            validation_pass "Non-ZFS system uses udev hook"
+        fi
+    fi
+}
+
+validate_initramfs_consolefont() {
+    step "Checking console font in initramfs"
+    local font_in_initramfs=$(ssh_cmd "lsinitcpio /boot/initramfs-linux*.img 2>/dev/null | grep -c 'consolefont.psf\\|ter-'")
+
+    if [ "${font_in_initramfs:-0}" -gt 0 ]; then
+        validation_pass "Console font included in initramfs"
+    else
+        validation_warn "Console font may not be in initramfs"
+    fi
+}
+
+validate_nvme_module() {
+    step "Checking NVMe module configuration"
+    local has_nvme=$(ssh_cmd "ls /dev/nvme* 2>/dev/null | head -1")
+
+    if [ -n "$has_nvme" ]; then
+        # System has NVMe drives
+        local modules=$(ssh_cmd "grep '^MODULES=' /etc/mkinitcpio.conf")
+        if echo "$modules" | grep -q 'nvme'; then
+            validation_pass "NVMe module in mkinitcpio MODULES"
+        else
+            validation_warn "NVMe system but nvme not in MODULES (may cause slow boot)"
+        fi
+    else
+        info "No NVMe drives detected"
+    fi
+}
+
 validate_autologin_config() {
     step "Checking autologin configuration"
     if ssh_cmd "test -f /etc/systemd/system/getty@tty1.service.d/autologin.conf" &>> "$LOGFILE"; then