Add secure boot helper

docs/TODO.md

@@ -693,10 +693,21 @@ full ~17-min Packer build.
 ## [ ] 10. (OPTIONAL) Secure Boot cert auto-enrollment for provisioning
 
 Speed up bringing up new workstations: bake the **public** PK/KEK/db certs into an
-image, detect Secure Boot **Setup Mode** at boot, and auto-enroll them with
-efitools (`efi-updatevar`/`KeyTool`) so a fresh/reset box adopts the fleet trust
-root without a manual firmware-setup visit. Pairs with #8 (signing) +
-[secure-boot-keys.md](secure-boot-keys.md).
+image, detect Secure Boot **Setup Mode** at boot, and auto-enroll them so a
+fresh/reset box adopts the fleet trust root without a manual firmware-setup visit.
+Pairs with #8 (signing) + [secure-boot-keys.md](secure-boot-keys.md).
+
+**Tooling gap (found 2026-06-20): `efitools` is NOT packaged for EL9** — no
+`efi-updatevar`/`efi-readvar`/`KeyTool`. Resolved for the OS-side path by writing
+the signed `.auth` variables to **efivarfs directly** (de-immutable + single
+write), which needs no extra package. **Done 2026-06-20:** baked
+`/usr/local/bin/fleet-sb-enroll` (efivarfs method, Setup-Mode-gated, fapolicyd-
+trusted) + the public `PK/KEK/db.auth` at `/usr/share/fleet-secureboot/` (supplied
+via `files/secureboot/keys/` or `SB_*_AUTH_B64` CI secrets); `mokutil` covers
+reading. So **manual** OS-side enrollment over SSH now works (`sudo
+fleet-sb-enroll`). What's left for *auto*-enroll: drive `fleet-sb-enroll`
+unattended on a **Setup-Mode detection** at boot, gated to a provisioning mode/UKI
+(below), with read-back verify + audit — NOT armed in the production image.
 
 **What's safe:** the certs are public (no key material — only the **db** private
 key signs, and it stays in CI/HSM, invariant #7); Setup Mode accepts