Second review pass: strip account fields, clear stale cidata inputs, await OEM finalization

Codex xhigh round 2:

- Strip account authentication fields (!users, !root-password,
  root_enc_password, auth_config account entries) from the archinstall config
  in OEM mode, not just user_credentials — a combined/legacy config could
  otherwise have archinstall create a provisioning account before OOBE.
- Clear stale OEM inputs (oem marker, credentials, optional files) from /root
  before copying a cidata drive, so a retried install in the same live session
  can't force a fresh drive back into OEM mode or reuse an old LUKS passphrase.
- The test harness waits for the OEM pending flag to clear before saving the
  base image, so it never snapshots a half-finalized first boot; it also
  handles the deliberately skipped mode picker on blank disks built against a
  pre-OEM runtime.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/cidata-load-test.sh

@@ -153,6 +153,29 @@ attach_drive cidata
 [[ ! -e $sandbox/root/oem ]] || fail "oem marker alone copies nothing"
 pass "oem marker alone falls back to the wizard"
 
+# Stale OEM inputs from a previous load in the same session are cleared before
+# the current drive is copied: a normal drive must not inherit an old oem
+# marker or credentials.
+new_sandbox
+attach_drive cidata
+write_required_pair
+: >"$sandbox/root/oem"                       # leftover from a prior OEM load
+echo 'old-keys' >"$sandbox/root/authorized_keys"
+run_load || fail "normal drive after a stale OEM load loads"
+[[ ! -e $sandbox/root/oem ]] || fail "stale oem marker is cleared"
+[[ ! -e $sandbox/root/authorized_keys ]] || fail "stale optional inputs are cleared"
+pass "stale OEM inputs are cleared before loading a normal drive"
+
+# A drive that isn't an autoinstall drive at all still clears stale inputs so
+# the wizard that follows doesn't inherit them.
+new_sandbox
+attach_drive cidata
+echo '{"disk_config": {}}' >"$sandbox/media/user_configuration.json" # half a pair
+: >"$sandbox/root/oem"
+! run_load || fail "half-pair drive still falls back"
+[[ ! -e $sandbox/root/oem ]] || fail "stale oem marker cleared even on fallback"
+pass "stale inputs are cleared even when falling back to the wizard"
+
 # Half the required pair is not an autoinstall drive: unmount and fall back.
 new_sandbox
 attach_drive cidata

test/test_oem_state.py

@@ -137,6 +137,20 @@ class ContextOemTest(unittest.TestCase):
         self.assertEqual(synthesized["users"], [])
         self.assertNotIn("root_enc_password", synthesized)
 
+    def test_oem_strips_account_fields_from_arch_config(self):
+        config = self.base_config(oem=True)
+        config["!users"] = [{"username": "rig"}]
+        config["!root-password"] = "hunter2"
+        config["root_enc_password"] = "x"
+        config["auth_config"] = {"users": [{"username": "rig"}], "root_enc_password": "x"}
+        self.write_config(config)
+        ctx = self.from_env()
+
+        arch_config = json.loads(ctx.arch_config_path.read_text())
+        for key in ("!users", "!root-password", "root_enc_password", "users"):
+            self.assertNotIn(key, arch_config)
+        self.assertEqual(arch_config["auth_config"], {})
+
     def test_oem_unencrypted_touches_nothing(self):
         self.write_config(self.base_config(oem=True))
         ctx = self.from_env()