feat: automate microcode, TLP radio enable, and ZFS tmp.mount mask

The 2026-04 velox setup left three manual fixes behind. All three now happen at install time.

- The TLP config sets DEVICES_TO_ENABLE_ON_STARTUP="bluetooth wifi". systemd-rfkill is masked on laptops because it fights TLP, so TLP is the only thing left that can restore radio state. Without this a fresh install can boot with both radios soft-blocked.
- mask_tmp_mount_for_zfs masks systemd's tmp.mount when the pool carries a dataset mounted at /tmp, so tmpfs can't shadow the dataset and break systemd-tmpfiles.
- install_cpu_microcode installs intel-ucode or amd-ucode by vendor_id, first in boot_ux so grub-mkconfig and mkinitcpio's microcode hook both see the ucode image.

New tests cover each function across normal, boundary, and error cases. The boot_ux and snapshot-dispatch sequence pins include the new calls.

1 files changed, 8 insertions, 6 deletions

diff --git a/tests/installer-steps/test_orchestrators.py b/tests/installer-steps/test_orchestrators.py
index a2b235b..395ec61 100644
--- a/tests/installer-steps/test_orchestrators.py
+++ b/tests/installer-steps/test_orchestrators.py
@@ -43,10 +43,10 @@ ORCHESTRATORS = {
         "install_devops_utilities",
     ],
     "boot_ux": [
-        "tighten_efi_permissions", "add_nvme_early_module",
-        "configure_initramfs_hook", "configure_encrypted_autologin",
-        "configure_tlp_power", "trim_firmware", "configure_grub",
-        "configure_pre_pacman_snapshots",
+        "install_cpu_microcode", "tighten_efi_permissions",
+        "add_nvme_early_module", "configure_initramfs_hook",
+        "configure_encrypted_autologin", "configure_tlp_power",
+        "trim_firmware", "configure_grub", "configure_pre_pacman_snapshots",
     ],
     "user_customizations": [
         "clone_user_repos", "stow_dotfiles", "prune_waybar_battery",
@@ -88,7 +88,8 @@ class OrchestratorSequence(unittest.TestCase):
 class SnapshotDispatch(unittest.TestCase):
     """configure_snapshots branches on filesystem; pin each branch."""
 
-    SUBS = ["configure_zfs_snapshots", "configure_btrfs_snapshots"]
+    SUBS = ["configure_zfs_snapshots", "configure_btrfs_snapshots",
+            "mask_tmp_mount_for_zfs"]
 
     def test_zfs_root_runs_zfs_snapshots(self):
         result = run_orchestrator(
@@ -96,7 +97,8 @@ class SnapshotDispatch(unittest.TestCase):
             extra_defs="is_zfs_root() { return 0; }\nis_btrfs_root() { return 1; }",
         )
         self.assertEqual(result.returncode, 0, result.stderr)
-        self.assertEqual(result.stdout.split(), ["configure_zfs_snapshots"])
+        self.assertEqual(result.stdout.split(),
+                         ["configure_zfs_snapshots", "mask_tmp_mount_for_zfs"])
 
     def test_btrfs_root_runs_btrfs_snapshots(self):
         result = run_orchestrator(