Refactor dnsmasq to build as a container. Add signed iPXE image build

docs/TODO.md

@@ -639,12 +639,19 @@ smoke test.
     the MS cert even in Setup Mode — looked like a non-empty-db rejection but was
     the NUL bug all along; it failed identically on a clean `pre-enrolled-keys=0`
     disk.)
+  - **iPXE signing WIRED (2026-06-21):** `snponly.efi` is now built + signed
+    (`db`) + pushed by CI as a separate FROM-scratch **`fleet-ipxe`** image
+    (`scripts/build-ipxe-oci.sh`, `.gitea/workflows/ipxe-image.yaml`), mounted into
+    dnsmasq at `/ipxe`. dnsmasq itself moved to a generic CI-built/pulled image
+    (`.gitea/workflows/dnsmasq-image.yaml`) — no longer built at deploy time, and
+    carries no keys/binary. (Decision: separate `fleet-ipxe` image, not baked into
+    dnsmasq, so the daemon image stays key-agnostic across SB environments.)
   - **REMAINING for production:** (a) **secure path** — re-verify signed boot with
     `disable_dot1x=false` (802.1X/MACsec), not just the test path; (b) **820 / PXE
-    path** — sign `snponly.efi` with the same `db` key so the iPXE front-end also
-    passes Secure Boot (the VM's HTTP path has no iPXE stage, so this is still
-    unverified on real PXE hardware); (c) confirm signing is reproducible (verity
-    hash stable across two signed builds).
+    path** — BENCH-VERIFY the signed `fleet-ipxe` chain on the 820 (the VM's HTTP
+    path has no iPXE stage, so the signed iPXE binary is still unverified on real
+    PXE hardware); (c) confirm signing is reproducible (verity hash stable across
+    two signed builds).
 - **PXE-only iPXE fallback — BENCH-VERIFIED on the EliteBook 820 G4 (2026-06-20).**
   Firmware without UEFI HTTP boot chainloads `serving/tftp/snponly.efi` → renders
   `autoexec.ipxe` (ifopen + DHCP-retry + `imgargs <real cmdline>`) → UKI over HTTP