Refactor dnsmasq to build as a container. Add signed iPXE image build

CLAUDE.md

@@ -33,7 +33,10 @@ files/plymouth/themes/fleet/              Custom boot splash (scripted security
 files/kiosk/                              weston+Chromium kiosk + chromium lockdown policy
 scripts/extract-artifacts.sh              qcow2 -> kernel/initramfs/erofs+verity/cmdline
 scripts/build-oci.sh                      ukify + sbsign + roothash gate + OCI image
+scripts/build-ipxe-oci.sh                 sbsign snponly.efi -> FROM-scratch fleet-ipxe image
 serving/                                  Lab serving stack: dnsmasq + nginx + SPDK
+                                          (dnsmasq + fleet-ipxe + SPDK images are
+                                          CI-built + pulled; see .gitea/workflows/)
 serving/kiosk-app/                         Svelte+Tailwind spaceship-terminal SPA
                                           (kiosk endpoint; nginx reverse-proxies /kiosk/)
 .gitea/workflows/                         Gitea CI: lint -> packer build -> push OCI
@@ -128,8 +131,13 @@ instead of working around it.
    SHA256SUMS}`. `rootfs.erofs` (erofs data) and `rootfs.hash` (dm-verity hash
    tree) are **separate** namespaces because the as-built Rocky 9 systemd does
    not support the in-file `hash-offset` verity layout. No shell, no tools, no
-   base image. Serving software (SPDK, nginx) lives in separate, independently
-   versioned images — never merge them into the artifact image.
+   base image. Serving software (SPDK, nginx, dnsmasq) lives in separate,
+   independently versioned images — never merge them into the artifact image.
+   The signed iPXE bootloader (`snponly.efi`) is its own FROM-scratch
+   **`fleet-ipxe`** image (`scripts/build-ipxe-oci.sh`, signed with `db`), mounted
+   into dnsmasq at `/ipxe` — kept out of *both* the artifact image and the
+   (generic, key-agnostic) dnsmasq image because its signature is
+   per-Secure-Boot-environment. Don't bake `snponly.efi` into the dnsmasq image.
 1. **Deployments are pinned by digest.** One commit per fleet release in
    the deployment manifest; that manifest is the single source coupling
    UKI ↔ namespace. Rollback = revert the commit.