fix(deploy): dropbear at boot on initramfs-tools, with dracut's image as the way back (ADR 0039, D20)

Ubuntu 26.04 builds its boot images with dracut, and dropbear-initramfs needs
initramfs-tools, which replaces it. The host's step 2 now installs
initramfs-tools with cryptsetup-initramfs beside dropbear, sets the boot
image's address in a conf.d file of its own, and checks every new image for
what opens the disk, dropbear, its key and the adapter's driver before any
reboot. Before switching, dracut's image of the running kernel is kept as an
entry in GRUB's menu (shown 5 s, the boot in text), so a failed image is
undone at the iMac without a USB stick.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

docs/adr/0039-halkyon-li-at-home.md

@@ -191,7 +191,13 @@
   never clashes with sshd's in a `known_hosts`). It takes melchior's key alone, which may
   run nothing but `cryptroot-unlock`. The USB network adapter's driver (`cdc_ncm`) is
   added to the initramfs. From away, a reboot waits for someone at home, as the tunnel
-  isn't up that early. The keyboard still works as before.
+  isn't up that early. The keyboard still works as before. Ubuntu 26.04 builds its boot
+  images with dracut, for which Ubuntu packages no SSH at boot; so initramfs-tools
+  replaces it, with `cryptsetup-initramfs` and Ubuntu's `dropbear-initramfs` (the
+  developer's choice of 8 Nov 2026, over the unpackaged dracut-sshd and over no
+  unlocking by SSH). dracut's last image stays in GRUB's menu, shown for 5 seconds, as
+  the way back until initramfs-tools' images have booted, so a failed image costs a
+  choice at the iMac rather than a USB stick.
 
 ## Consequences