Refactor dnsmasq to build as a container. Add signed iPXE image build

serving/dnsmasq/entrypoint.sh

@@ -23,8 +23,18 @@
 set -eu
 
 mkdir -p /srv/tftp
-# User-supplied iPXE binary (snponly.efi) from the read-only source mount.
-cp -f /tftp-src/*.efi /srv/tftp/ 2>/dev/null || true
+# iPXE binary (snponly.efi) into the TFTP root. Prefer the signed binary from the
+# mounted fleet-ipxe image (/ipxe); fall back to the read-only bind mount
+# (/tftp-src) for offline/lab use. The dnsmasq image carries no .efi itself.
+if ls /ipxe/*.efi >/dev/null 2>&1; then
+  cp -f /ipxe/*.efi /srv/tftp/
+  echo "iPXE bootloader source: /ipxe (fleet-ipxe image)"
+elif ls /tftp-src/*.efi >/dev/null 2>&1; then
+  cp -f /tftp-src/*.efi /srv/tftp/
+  echo "iPXE bootloader source: /tftp-src (bind mount, lab fallback)"
+else
+  echo "WARN: no iPXE binary in /ipxe or /tftp-src — PXE-only clients can't chainload" >&2
+fi
 # autoexec.ipxe was an STP-era workaround (ifopen+retry before autoboot); it's no
 # longer rendered — PortFast on the switch port is the real fix. Remove any stale
 # copy left in a long-lived container's writable layer.