main/mkinitfs: trigger via kernel-hooks

This makes the bootloader update mechanism consistent between systems that use secureboot uefi bundles and systems that don't: the bootloader is always set up via kernel-hooks.

It also provides a place where we can logically order different operations that need to happen when the kernel updates both before and after mkintifs generation (e.g.: copying the initfs to a second location).