Second review pass: strip account fields, clear stale cidata inputs, await OEM finalization

Codex xhigh round 2:

- Strip account authentication fields (!users, !root-password,
  root_enc_password, auth_config account entries) from the archinstall config
  in OEM mode, not just user_credentials — a combined/legacy config could
  otherwise have archinstall create a provisioning account before OOBE.
- Clear stale OEM inputs (oem marker, credentials, optional files) from /root
  before copying a cidata drive, so a retried install in the same live session
  can't force a fresh drive back into OEM mode or reuse an old LUKS passphrase.
- The test harness waits for the OEM pending flag to clear before saving the
  base image, so it never snapshots a half-finalized first boot; it also
  handles the deliberately skipped mode picker on blank disks built against a
  pre-OEM runtime.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

bin/omarchy-iso-test

@@ -703,7 +703,7 @@ drive_oem_setup() {
   capture_console "success-oem-02-password"
   press ret
 
-  wait_for_screen "Confirm" 60
+  wait_for_screen "Conf *irm" 60
   type_text "$GUEST_PASSWORD"
   press ret
 
@@ -932,6 +932,25 @@ install_phase() {
   fi
   bootstrap_ssh
 
+  # SSH can come up (console bootstrap logs in on a spare TTY) while
+  # omarchy-oem-setup is still finalizing the user and re-keying LUKS. Saving
+  # the base mid-finalization produces a flaky image, so wait for the pending
+  # flag to clear before powering off.
+  if $OEM; then
+    log "Waiting for OEM first-boot setup to finish"
+    local waited=0
+    while ssh_guest "test -f /var/lib/omarchy/oem/pending" 2>/dev/null; do
+      if ((waited >= 900)); then
+        capture_console "failure-oem-finalization-timeout"
+        echo "Timed out waiting for OEM first-boot setup to complete" >&2
+        return 1
+      fi
+      sleep 10
+      ((waited += 10))
+    done
+    capture_console "success-oem-06-setup-complete"
+  fi
+
   ssh_guest "echo $GUEST_PASSWORD | sudo -S cat /var/log/omarchy-install-timing.json 2>/dev/null" \
     >"$RUN_DIR/omarchy-install-timing.json" 2>/dev/null || true
   ssh_guest "echo $GUEST_PASSWORD | sudo -S cat /var/log/pacman.log 2>/dev/null" \