[atoav]

  > Forensics agent pulls and mounts hard drive

Is this what the typical airport threat scenario looks like? How do they do this with soldered in drives?

  > Agent sees /home/hiddenuser

Or they see nothing, because your drive is encrypted. They come to ask you for the key, you comply they see $blandaccount with some seemingly important company data and a scary corporate message as the desktop background (as justification why there is even encryption). Bonus points if you complain about it yourself ("If you ask me all of this is a bit paranoid"). Afterwards you use the real key and see $realaccount, because you thought about plausible deniability and how to use it propperly – if you still trust the integrity of your device, that is.