o pwd_mkdb(8)'s `-p' likely only cares about /etc/passwd
o Regenerate for each phase, pkg(8) seems to like that
o Also restore a clobbered /etc/shells including our root shell

runtime regeneration.  Not pretty, but better than triggering it
only once on bootup.  More clog -> newsyslog migration to be done
soon.

Discussed with: ad@

o Sharpen the text for permitting root login and password.
o Migration kills the default of not permitting passwords.

Must move the git mount up to test this properly.