install.sh: ship cold-boot optimisations with firmware updates

Persist the cold-boot wins (was: only manually deployed via
tmp/20260501_restart_timing/deploy-fast.sh, would silently revert on
the next prod firmware update).

- Install bbserial-rebind.service alongside bbctrl.service and enable
  it. Eliminates the rc.local bbserial reload mid-boot.
- Prefer scripts/rc.local.fast over scripts/rc.local when present.
  Legacy rc.local left as a fallback for old firmware tarballs.
- Mask plymouth-read-write, plymouth-quit-wait, and raspi-config.
  Together these were ~6s of userspace startup that bought nothing
  on a deployed Onefinity Pi.

Cumulative: bbctrl listening at boot+10.6s (was 20.6s), userspace
boot 11.5s (was ~13s), bbctrl.service @2.9s in critical-chain (was
@6.5s after the first optimisation pass).

scripts/install.sh

@@ -19,8 +19,17 @@ if $UPDATE_PY; then
     # Update service
     rm -f /etc/init.d/bbctrl
     cp scripts/bbctrl.service /etc/systemd/system/
+
+    # Cold-boot fast path:
+    #   - bbserial-rebind.service replaces the bbserial unbind/reload
+    #     that used to live in rc.local AFTER bbctrl was already
+    #     listening on /dev/ttyAMA0. Doing it as a unit ordered
+    #     Before=bbctrl.service eliminates a full bbctrl restart
+    #     mid-boot (~5s saved).
+    cp scripts/bbserial-rebind.service /etc/systemd/system/
     systemctl daemon-reload
     systemctl enable bbctrl
+    systemctl enable bbserial-rebind.service
 fi
 
 if $UPDATE_AVR; then
@@ -118,8 +127,31 @@ if [ $? -ne 0 ]; then
     REBOOT=true
 fi
 
-# Install rc.local
-cp scripts/rc.local /etc/
+# Install rc.local. Use the slimmed "fast" variant if it exists in this
+# checkout (preferred); fall back to the legacy rc.local for older
+# firmware tarballs that don't ship rc.local.fast yet.
+if [ -f scripts/rc.local.fast ]; then
+    cp scripts/rc.local.fast /etc/rc.local
+else
+    cp scripts/rc.local /etc/rc.local
+fi
+chmod +x /etc/rc.local
+
+# Cold-boot: mask units that contribute to userspace startup time but
+# do not benefit a deployed Onefinity Pi. Each is reversible with
+# `systemctl unmask <unit>`.
+#   plymouth-read-write : 4s of work for a splash that rc.local kills
+#                         immediately with `plymouth quit`.
+#   plymouth-quit-wait  : holds graphical.target until the splash is
+#                         fully gone; redundant once the splash is
+#                         masked.
+#   raspi-config        : one-shot first-boot config; on a deployed
+#                         image it's a 2s no-op.
+# Use --now so the change also applies to the running system; harmless
+# on a fresh install where the units are inactive.
+for unit in plymouth-read-write.service plymouth-quit-wait.service raspi-config.service; do
+    systemctl mask --now "$unit" 2>/dev/null || true
+done
 
 # Ensure that the watchdog python library is installed
 pip3 list --format=columns | grep watchdog >/dev/null