fix: show a generated password once, and record the updates answer

[marcos-mendez]

From the maintainer's screenshots of the Core image (2026-10-02). inithooks 2.3.6+keel16 (master took keel15; master is merged in).

• 002/003, generated password (the flow of feat: offer a generated password in the first boot dialogs #27). Root cause: the screen showing the password says "It is not shown again", and the "Did you save this password?" question after it showed the password again. The safer fix is to keep that promise, so the question no longer shows the password: "Did you save the password?" with Saved and New as before. New generates another password, which is also shown only once.
• 034/058, security updates. Root cause: nothing on the machine recorded the first boot's answer, so keel inspect fell back on the cron-apt install action that every image ships and reported force after Skip. 95secupdates now writes skip or force to /var/lib/inithooks/sec-updates, for both a preseeded and an interactive answer. keel 0.15.1 (fix: inspect, confirm and monit on a Keel Core (keel#60, keel#61) keel#64) reads that file. If the file cannot be written, the hook logs it and the boot continues. The hook now takes INITHOOKS_DEFAULT, SEC_UPDATES_RECORD and SEC_UPDATES_LOG from the environment, for its first tests.

Tests written first:

• Python: 373 tests pass. dialog_wrapper.py stays at 98 percent (the same lines are missed). New tests check that the password appears on one screen only.
• Shell: the new tests/test-secupdates.bats covers 49 of 50 lines of 95secupdates. The shell total is 99.58, against a threshold of 98.

Real test: an LXC container from the step 7b Core image, with this package installed before the first boot. Generate showed the password once; the question did not show it. Choosing Skip left skip in /var/lib/inithooks/sec-updates, and keel inspect reported skip. The container was destroyed afterwards.

• CI green
• Review