fix: a first boot nobody can answer asks nothing, and names the machine

[marcos-mendez]

Three findings of the Web image (keel-web 19.0-3, inithooks 2.3.6+keel21) booted headless in an LXC container with no console attached, 2026-10-03.

1. 31fqdn held the first boot. Unless FQDN=SKIP was preseeded, its screen waited on tty1, a pty nobody reads. lib/console.sh is now the one rule for run's notices and every hook that draws a screen. Nobody can answer a console with no size (stty 0 0), one that does not take a 128 KiB NUL probe within 2 s, or no terminal at all. A small write is not enough: an unread pty takes about 17 KB before it blocks (measured on 6.12), so the screen after a small write would still hang. run asks once and exports INITHOOKS_UNATTENDED. From then on the hooks' output goes to the inithooks log, because a console nobody reads blocks its writer once its buffer is full (95secupdates prints the whole upgrade). Each hook logs one line and does what it does with no answer:

• 30rootpass keeps the password
• 31fqdn keeps the name and records instance.hostname/fqdn if the name is a valid FQDN
• 75keel-role and 80keel-cloud run confconsole's screen with stdin from /dev/null. keelfirstboot.py then draws nothing and still stores a preseeded key, so confconsole needs no change.
• 85secalerts sets no email
• 95secupdates installs and 99reboot reboots, as SEC_UPDATES=FORCE (the headless preseed) does

The README's preseed example lists FQDN and says an unattended boot skips the questions.

2. CN=core on a machine named web. Given no names, the fork's turnkey-make-ssl-cert sets CN and SAN from hostname -A, a reverse lookup of every address, which falls back to hostname. It supports SANs and --ip. 15regen-sslcert now passes the fqdn and the hostname with --ip (lib/sslcert.sh, names from fqdn.py --machine, no DNS). 31fqdn makes the certificate again when the name it settles is not the CN of a self-signed one. A certificate signed by an authority (confconsole's Let's Encrypt writes the same files) is kept. Nothing is generated at build time.

3. No /etc/hosts line after a skip. 31fqdn now ends every first boot with 127.0.1.1 <fqdn> <hostname>, or 127.0.1.1 <hostname> without a domain, which matches what keel's apply --system writes (keel/system/hosts.py). A kept name keeps the domain its hosts line already gives it.

Tested. New tests/test-console.bats: every interactive hook runs on an unsized pty and on a sized pty whose master is never read, within a deadline, and must finish. Run against master's 31fqdn, those tests fail. Also added: hosts and certificate tests in test-fqdn.bats (CN after a rename with real openssl), test-run.bats, test-secupdates.bats, test-keel-firstboot.bats, test-regen-sslcert.bats, and pytest for --machine. Local run: 367 bats, including the real-dialog pty tests, and 530 pytest. Shell coverage is 99.69 and Python 99.