Skip the encrypt hook on verified plain roots

[Skeptomenos]

Omarchy always includes mkinitcpio's classic encrypt hook. On a direct unencrypted root with no cryptdevice=, the hook tries to treat root= as an encrypted mapping and prints an early boot error. The system can still boot, but the message indicates a configuration that does not match the storage layout.

This change keeps the complete current hook list as the safe default. It removes only encrypt when findmnt and lsblk prove that root is a direct ext4 or Btrfs filesystem backed only by a partition or disk. Encrypted, LVM, RAID, unsupported and unknown layouts keep encrypt. Explicit classic-encrypt selectors, active crypttab.initramfs rows and all discovery failures also keep it.

The migration evaluates the installed hook configuration without privilege. It rebuilds affected existing images with limine-mkinitcpio, or mkinitcpio -P when Limine is absent. It records completion only after a successful rebuild, so failures remain retryable across users.

Validation:

• 18 focused hook cases cover plain ext4/Btrfs, dm-crypt, LVM, RAID, selectors, crypttab and discovery failures.
• 7 migration cases cover unprivileged classification, Limine, mkinitcpio, repeated users, rebuild retry and no-op paths.
• NVIDIA KMS and keyboard-layout hook regressions pass.
• The same commit applies cleanly to the Apple Silicon fork and preserves its Asahi-specific hook list.
• A real direct ext4 root on an M2 MacBook Air resolves to part → disk and omits only encrypt.

Related to #6876. This PR handles the verified direct plain-root case and leaves the broader storage-hook redesign to that issue.