boot: cold-boot optimisations cutting bbctrl listen by ~8s on the Pi

- scripts/rc.local.fast: minimal rc.local that defers the heavy bits.
- scripts/bbserial-rebind.service: oneshot unit that unbinds ttyAMA0
  from pl011 and (re)loads bbserial before bbctrl.service.
- scripts/bbctrl.service: declare the After/Wants on bbserial-rebind
  so we can rely on it rather than racing rc.local.
- scripts/install.sh: ship the cold-boot bits with firmware updates
  (mask sysstat, replace dphys-swapfile with an fstab swap entry).
- scripts/rc.local + setup_rpi.sh + setup.py: wire updated paths.

scripts/install.sh

@@ -19,8 +19,17 @@ if $UPDATE_PY; then
     # Update service
     rm -f /etc/init.d/bbctrl
     cp scripts/bbctrl.service /etc/systemd/system/
+
+    # Cold-boot fast path:
+    #   - bbserial-rebind.service replaces the bbserial unbind/reload
+    #     that used to live in rc.local AFTER bbctrl was already
+    #     listening on /dev/ttyAMA0. Doing it as a unit ordered
+    #     Before=bbctrl.service eliminates a full bbctrl restart
+    #     mid-boot (~5s saved).
+    cp scripts/bbserial-rebind.service /etc/systemd/system/
     systemctl daemon-reload
     systemctl enable bbctrl
+    systemctl enable bbserial-rebind.service
 fi
 
 if $UPDATE_AVR; then
@@ -118,8 +127,50 @@ if [ $? -ne 0 ]; then
     REBOOT=true
 fi
 
-# Install rc.local
-cp scripts/rc.local /etc/
+# Install rc.local. Use the slimmed "fast" variant if it exists in this
+# checkout (preferred); fall back to the legacy rc.local for older
+# firmware tarballs that don't ship rc.local.fast yet.
+if [ -f scripts/rc.local.fast ]; then
+    cp scripts/rc.local.fast /etc/rc.local
+else
+    cp scripts/rc.local /etc/rc.local
+fi
+chmod +x /etc/rc.local
+
+# Cold-boot: mask units that contribute to userspace startup time but
+# do not benefit a deployed Onefinity Pi. Each is reversible with
+# `systemctl unmask <unit>`.
+#   plymouth-read-write : 4s of work for a splash that rc.local kills
+#                         immediately with `plymouth quit`.
+#   plymouth-quit-wait  : holds graphical.target until the splash is
+#                         fully gone; redundant once the splash is
+#                         masked.
+#   raspi-config        : one-shot first-boot config; on a deployed
+#                         image it's a 2s no-op.
+#   sysstat             : sadc CPU/IO stats logger; not used.
+# Use --now so the change also applies to the running system; harmless
+# on a fresh install where the units are inactive.
+for unit in \
+    plymouth-read-write.service \
+    plymouth-quit-wait.service \
+    raspi-config.service \
+    sysstat.service; do
+    systemctl mask --now "$unit" 2>/dev/null || true
+done
+
+# Cold-boot: switch swap activation from dphys-swapfile (~4.3s LSB
+# wrapper that re-checks the swap file size on every boot) to a plain
+# fstab entry. The swap file itself is already created at
+# /var/swap by the previous boot; we only need to make sure it gets
+# `swapon`'d at local-fs.target instead.
+SWAPFILE=/var/swap
+if [ -f "$SWAPFILE" ]; then
+    if ! grep -qE "^[^#]*${SWAPFILE//\//\\/}[[:space:]]+swap" /etc/fstab; then
+        echo "$SWAPFILE none swap sw 0 0" >> /etc/fstab
+    fi
+    systemctl mask --now dphys-swapfile.service 2>/dev/null || true
+    swapon -a 2>/dev/null || true
+fi
 
 # Ensure that the watchdog python library is installed
 pip3 list --format=columns | grep watchdog >/dev/null