Add systemd-boot-efi to the runner

.gitea/workflows/gitea-main-ci.yaml

@@ -82,9 +82,14 @@ jobs:
         # make /boot readable (Ubuntu ships vmlinuz mode 0600).
         run: |
           sudo apt-get update
+          # systemd-boot-efi ships the UKI EFI stub
+          # (/usr/lib/systemd/boot/efi/linuxx64.efi.stub) that ukify wraps the
+          # kernel+initrd+cmdline around. It's only a *recommends* of
+          # systemd-ukify, so --no-install-recommends would otherwise skip it.
           sudo apt-get install -y --no-install-recommends \
             qemu-system-x86 qemu-utils libguestfs-tools linux-image-generic \
-            erofs-utils cryptsetup-bin jq systemd-ukify buildah shellcheck
+            erofs-utils cryptsetup-bin jq systemd-ukify systemd-boot-efi \
+            buildah shellcheck
           sudo chmod 0644 /boot/vmlinuz-* 2>/dev/null || true
 
       -

CLAUDE.md

@@ -49,8 +49,10 @@ bash -n files/dracut/95dot1x-macsec/*.sh scripts/*.sh   # shell syntax gate
 shellcheck --exclude=SC1091,SC2154 files/dracut/95dot1x-macsec/*.sh scripts/*.sh
 ```
 
-Build-host deps: qemu-kvm, libguestfs-tools, erofs-utils, cryptsetup, jq,
-systemd-ukify, sbsigntools, buildah (or docker).
+Build-host deps: qemu-kvm, libguestfs-tools (+ a kernel for its supermin
+appliance), erofs-utils, cryptsetup, jq, systemd-ukify **and systemd-boot-efi**
+(the latter ships the `linuxx64.efi.stub` ukify needs), sbsigntools,
+buildah (or docker).
 
 ## Architecture invariants — do not violate these
 

README.md

@@ -36,7 +36,8 @@ docs/diskless-fleet-design-v2.pdf         Architecture design (authoritative)
 - Packer >= 1.10, qemu plugin (`packer init .`)
 - qemu-kvm with KVM available
 - libguestfs-tools, **erofs-utils**, **cryptsetup**, jq (artifact extraction)
-- **systemd-ukify** (+ **sbsigntools** when signing) — UKI assembly
+- **systemd-ukify** + **systemd-boot-efi** (the EFI stub `ukify` wraps;
+  it's only a *recommends* of ukify) (+ **sbsigntools** when signing) — UKI assembly
 - **buildah** (or docker) — OCI release-artifact image build
 
 The default `iso_url`/`iso_checksum` point at a version-pinned **Rocky 9.x