Just spotted that .disk/profile.tgz would hold
distcfg.mk with pre-expanded $(HOME) from build
host which is both info leak (user account that
was used to build the particular image) and just
wrong given that the in-image profile archive was
conceived as a means to pass that part of build
environment over instead of tying it to vendor.

Morale: premature optimization is premature.