Moves the Caps Lock gate from the ENCRYPT confirmation to immediately before the cryptsetup call, and requires 'yes' in lower case — which cannot be typed with Caps Lock on, so accepting it is the proof.
cryptsetup asks "Are you sure? (Type 'yes' in capital letters)" one prompt before it asks for the new passphrase. Reaching for Caps Lock to type that YES leaves it on for the passphrase, which cryptsetup takes twice and inverts both times — so its verification passes and the boot prompt is where you find out. The old gate warned about this before the btrfs shrink and integrity check, far too early, and read a keyboard LED that reports nothing over Bluetooth.
Also guards the stage-6d /etc/kernel/cmdline redirect with mkdir -p: unguarded, it is the same silent 'set -e' abort as the stage-6c bug fixed in v1.8.2 (#2).