Remove the encrypt initramfs hook from unencrypted installs

[jonbng]

Problem

omarchy-settings includes the encrypt mkinitcpio hook for every installation.

On an unencrypted system, the hook interprets the normal root=PARTUUID=... argument as an encrypted-root device and prints:

Failed to open encryption mapping: The device PARTUUID=... is not a LUKS volume

Boot continues, but the error is misleading.

Solution

Before building the final UKI:

• Remove the encrypt hook for unencrypted installations.
• Keep it for encrypted installations.
• Restore it before filesystems when an encrypted installation is missing the hook.

Testing

Added tests covering:

• Removal for unencrypted installations.
• Preservation for encrypted installations.
• Restoration when an encrypted installation is missing the hook.

Focused unit suite passes: 26 tests.

[Copilot]

Pull request overview

This PR updates the installer’s Limine finalization step to ensure the encrypt mkinitcpio hook is only present when the target root filesystem is actually encrypted (LUKS), eliminating a misleading boot-time error on unencrypted systems while preserving/restoring correct behavior for encrypted installs.

Changes:

• Add _configure_initramfs_encryption_hook() and invoke it during finalize_limine_boot() to remove encrypt on unencrypted installs and restore it (preferably before filesystems) when encryption is in use.
• Add unit tests covering removal, preservation, and restoration of the encrypt hook.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
configs/airootfs/usr/share/omarchy-iso/orchestrator/phases_impl.py	Adds hook reconciliation logic and runs it before the final Limine/UKI build step.
test/unit/test_provisioning_state.py	Adds unit tests validating hook removal/retention/restoration behavior across encrypted vs unencrypted contexts.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.