[finalJ2]

This adds the Thunderbolt details that the T2-Mint maintainer asked to have in the wiki instead of the T2-Mint README: t2linux/T2-Mint#30

• state.md: notes in the Thunderbolt row that connected devices must be authorized (security level user), and links to the new section.
• guides/postinstall.md: adds a "Booting from a Thunderbolt drive" section. If / is on a Thunderbolt drive, the drive has to be authorized inside the initramfs, where boltd is not running, or boot stops at the (initramfs) prompt. The section covers the one-off workaround from that prompt and a udev rule that initramfs-tools copies into the initramfs.

Tested on a Mac mini (2018) with Linux Mint 22.3 (T2-Mint v7.1.8-1, now kernel 7.2.11-3-t2-noble), with the root filesystem on an NVMe SSD in an ACASIS TBU405Pro enclosure connected over Thunderbolt 3:

• Without the rule, boot stopped at the (initramfs) prompt. Writing 1 to the device's authorized attribute and running exit continued the boot.
• With the rule installed and update-initramfs -u, the rule was present in the initramfs (lsinitramfs), and reboots over Thunderbolt complete without intervention.
• boltctl enroll --policy auto stored the already-authorized enclosure in bolt.

I have only tested initramfs-tools, so the section only gives concrete steps for it and points other initramfs generators to their documentation.