fix(migration): survive oversized tarballs — tmpfs cap, pre-reboot RAM gate, auto-restore on pre-format failure

[mrosseel]

From a live failure on a 2GB Pi: the initramfs copies the migration tarball into RAM, and a 1GB tarball hit the tmpfs default cap (50% of RAM) — then the failure stranded the headless device in a console-only debug shell, with recovery requiring SD card surgery.

• tmpfs cap raised to 90% in the initramfs — the explicit MemAvailable checks are the real guard; the default cap must never trip first.
• Pre-reboot feasibility gate in nixos_migration.sh: if tarball + 400MB > MemTotal, fail on the running OS with a clear message, before /boot is touched.
• Auto-restore on pre-format failure: any initramfs failure before the first mkfs restores config.txt/cmdline.txt from the .premigration backups, removes the boot flag, and reboots back into the old OS. A DESTRUCTIVE marker arms at the first format; only failures after that point drop to the debug shell.

Companions: the migration closure itself shrinks ~760MB on the fork's nixos branch (full linux-firmware → Broadcom blobs), and #522 adds a release-time budget so an oversized tarball can never ship again.

🤖 Generated with Claude Code

[mrosseel]

Round-two field failure, second commit: the init script predates the boot-on-ext4 layout. The tarball's top-level boot/ (firmware payload) and rootfs/boot (extlinux + kernels, now non-empty) collided on the same path — and the failing mv had no || fail, so set -e killed init: kernel panic instead of the debug shell. Fixes: firmware payload staged aside before the rootfs move; both partition verifications now check what each actually needs (config.txt on FAT, extlinux.conf on ext4 — two places demanded extlinux on FAT, where it no longer lives); an EXIT trap routes any uncaught failure into fail() (disarmed before the deliberate final reboot), so a panic is structurally impossible.

[mrosseel]

Restacked on top of #521 (this PR now includes #521's commits — merge #521 first, then this fast-forwards). Reason, from the live rehearsal: both PRs carried full copies of nixos_migration_init.sh with divergent regions, and a multi-branch merge resolved one block from the stale side — the migration failed at the final (already-fixed-here) verification. Single lineage makes that structurally impossible, and also removes this branch's inherited copy of the old hex SSID converter. Second commit here additionally fixes the initramfs for the boot-on-ext4 layout (firmware payload staged aside; per-partition verification; EXIT trap so failures can never kernel-panic).