Refactor dnsmasq to build as a container. Add signed iPXE image build

serving/tftp/README.md

@@ -1,11 +1,25 @@
 # TFTP root — iPXE chainload for PXE-only firmware
 
-This directory is mounted read-only at `/srv/tftp` in the dnsmasq container and
-serves the iPXE network bootloader over TFTP to firmware that **lacks UEFI HTTP
-boot** (e.g. HP EliteBook 820 G4). HTTP-boot-capable firmware never touches this
-path — it gets the UKI straight over HTTP (see the `httpboot` tag in
-`docker-compose.yml`). The fallback is automatic, driven by what each client
-advertises (DHCP vendor-class / client-arch).
+The iPXE network bootloader (`snponly.efi`) is served over TFTP to firmware that
+**lacks UEFI HTTP boot** (e.g. HP EliteBook 820 G4). HTTP-boot-capable firmware
+never touches this path — it gets the UKI straight over HTTP (see the `httpboot`
+tag in `docker-compose.yml`). The fallback is automatic, driven by what each
+client advertises (DHCP vendor-class / client-arch).
+
+> **Where `snponly.efi` comes from (production): the `fleet-ipxe` OCI image.**
+> CI builds it, **signs it with the fleet `db` key**, and pushes a tiny
+> FROM-scratch image (`.gitea/workflows/ipxe-image.yaml` →
+> `scripts/build-ipxe-oci.sh`). The dnsmasq container mounts that image at
+> `/ipxe` and the entrypoint copies `/ipxe/snponly.efi` into `/srv/tftp`. It's a
+> **separate, per-Secure-Boot-environment image** (its signature is `db`-specific)
+> so the dnsmasq image itself stays generic — see docs/secure-boot-keys.md and
+> CLAUDE.md invariant #9.
+>
+> **This directory is the offline/lab fallback only:** if you drop an
+> `snponly.efi` here and enable the commented `./tftp:/tftp-src:ro` bind in
+> `docker-compose.yml`, the entrypoint uses it when `/ipxe` is empty (it prefers
+> `/ipxe`, then falls back to `/tftp-src`). Handy on Docker < 28 or when iterating
+> without a registry round-trip.
 
 Flow for a PXE-only host: