Initial Secure boot setup

diskless.pkr.hcl

@@ -253,6 +253,20 @@ build {
       # dracut warns and silently falls back to gzip (a larger initramfs).
       "dnf -y install wpa_supplicant tpm2-tools tpm2-tss nvme-cli cryptsetup dracut-network NetworkManager zstd openssl",
 
+      # EFI / Secure Boot management tools, for MANUAL key enrollment over SSH on
+      # a workstation in Setup Mode: efitools (efi-updatevar, efi-readvar,
+      # cert-to-efi-sig-list, sign-efi-sig-list, KeyTool) + efivar/mokutil/
+      # efibootmgr companions. See docs/secure-boot-keys.md ("Manual enrollment");
+      # auto-enroll is TODO #10. They write to efivarfs
+      # (/sys/firmware/efi/efivars), NOT the read-only root, so they work at
+      # runtime; RPM-installed => already fapolicyd-trusted (no STIG trust edit).
+      # efitools is EPEL-only on el9: enable EPEL just to pull it, then drop the
+      # repo so a non-kiosk image's repo set is unchanged (kiosk builds re-add it).
+      "dnf -y install efivar mokutil efibootmgr",
+      "rpm -q efitools >/dev/null 2>&1 || { dnf -y install epel-release && dnf -y install efitools && EFITOOLS_EPEL=1; } || true",
+      "rpm -q efitools >/dev/null 2>&1 && echo '==> EFI Secure Boot tools installed (efitools + efivar/mokutil/efibootmgr)' || echo 'WARNING: efitools not installed (EPEL unavailable?) — manual SB enrollment tooling missing' >&2",
+      "[ \"$${EFITOOLS_EPEL:-0}\" = 1 ] && dnf -y remove epel-release >/dev/null 2>&1 || true",
+
       # Plymouth boot splash. The custom scripted 'fleet' theme renders the
       # security-handshake checklist driven by the dracut hooks
       # (`plymouth update --status=...`). plymouth-plugin-label gives Image.Text