fix(deploy): dropbear at boot on initramfs-tools, with dracut's image as the way back (ADR 0039, D20)

Ubuntu 26.04 builds its boot images with dracut, and dropbear-initramfs needs
initramfs-tools, which replaces it. The host's step 2 now installs
initramfs-tools with cryptsetup-initramfs beside dropbear, sets the boot
image's address in a conf.d file of its own, and checks every new image for
what opens the disk, dropbear, its key and the adapter's driver before any
reboot. Before switching, dracut's image of the running kernel is kept as an
entry in GRUB's menu (shown 5 s, the boot in text), so a failed image is
undone at the iMac without a USB stick.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

deploy/host/grub-dracut-fallback

@@ -0,0 +1,27 @@
+#!/bin/sh
+# The way back to the boot image dracut made (ADR 0039, D20), as
+# /etc/grub.d/41_dracut_fallback (root, 0755) on the instance's host at home, which
+# update-grub runs. Ubuntu 26.04 builds its boot images with dracut, and
+# dropbear-initramfs needs initramfs-tools, which replaces it: should an image of
+# initramfs-tools not open the root disk, this entry boots a kernel with the image
+# dracut had made for it, kept beside it as initrd.img-<version>.dracut. Chosen at the
+# iMac in GRUB's menu (grub-halkyon.cfg). Once initramfs-tools' images have booted,
+# the copy and this file may go.
+set -e
+boot=$(findmnt -no UUID /boot)
+for image in /boot/initrd.img-*.dracut; do
+  [ -e "$image" ] || continue
+  version=${image#/boot/initrd.img-}
+  version=${version%.dracut}
+  [ -e "/boot/vmlinuz-$version" ] || continue
+  echo "Found the way back: $version with dracut's image" >&2
+  cat <<EOF
+menuentry 'Ubuntu, $version with dracut (the way back)' {
+	insmod part_gpt
+	insmod ext2
+	search --no-floppy --fs-uuid --set=root $boot
+	linux /vmlinuz-$version root=/dev/mapper/ubuntu--vg-ubuntu--lv ro
+	initrd /initrd.img-$version.dracut
+}
+EOF
+done