install.sh: mask sysstat, replace dphys-swapfile with fstab entry

Round-3 cold-boot trims:
- mask sysstat.service (sadc CPU/IO logger; nothing reads it).
- mask dphys-swapfile.service and add /var/swap to /etc/fstab so swap
  is brought up by systemd at local-fs.target instead of by an LSB
  wrapper that re-checks the swap file size on every boot.

Both are reversible: `systemctl unmask <unit>` and remove the fstab
line. Before doing the dphys swap, install.sh verifies /var/swap
exists; on a fresh image where the file hasn't been created yet,
nothing is changed and dphys-swapfile keeps running normally.

Userspace boot 11.5s -> 10.7-11.4s on clean runs; bbctrl listen
unchanged at boot+10.4s (the saving moves to chromium/multi-user).

scripts/install.sh

@@ -147,12 +147,31 @@ chmod +x /etc/rc.local
 #                         masked.
 #   raspi-config        : one-shot first-boot config; on a deployed
 #                         image it's a 2s no-op.
+#   sysstat             : sadc CPU/IO stats logger; not used.
 # Use --now so the change also applies to the running system; harmless
 # on a fresh install where the units are inactive.
-for unit in plymouth-read-write.service plymouth-quit-wait.service raspi-config.service; do
+for unit in \
+    plymouth-read-write.service \
+    plymouth-quit-wait.service \
+    raspi-config.service \
+    sysstat.service; do
     systemctl mask --now "$unit" 2>/dev/null || true
 done
 
+# Cold-boot: switch swap activation from dphys-swapfile (~4.3s LSB
+# wrapper that re-checks the swap file size on every boot) to a plain
+# fstab entry. The swap file itself is already created at
+# /var/swap by the previous boot; we only need to make sure it gets
+# `swapon`'d at local-fs.target instead.
+SWAPFILE=/var/swap
+if [ -f "$SWAPFILE" ]; then
+    if ! grep -qE "^[^#]*${SWAPFILE//\//\\/}[[:space:]]+swap" /etc/fstab; then
+        echo "$SWAPFILE none swap sw 0 0" >> /etc/fstab
+    fi
+    systemctl mask --now dphys-swapfile.service 2>/dev/null || true
+    swapon -a 2>/dev/null || true
+fi
+
 # Ensure that the watchdog python library is installed
 pip3 list --format=columns | grep watchdog >/dev/null
 if [ $? -ne 0 ]; then