We should add a way of indicating the root filesystem is supposed to be bootable read-only e.g. adding read-only-rootfs to IMAGE_FEATURES; if this is set we can check during do_rootfs if there are any postinstall scripts to be run on first boot and fail if any are found. This switch may also be useful if we need to tweak anything else during rootfs construction in the case of a read-only system.
Turns out the ipk backend already does exactly this; presumably it just needs to be implemented for rpm (or in a more generic manner).
I have a preliminary patch for this, still need to test it.
Merged to master: http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?id=8ca0d592c5c266741ea00bc2629ef031506f834e
Verified on master branch. Commit ID: 9ffee9add2d0380f4025e7a678a166f25a7d659e
This is covered with the following Testopia test case: https://bugzilla.yoctoproject.org/tr_show_case.cgi?case_id=741