Update pxe boot flow

docs/TODO.md

@@ -626,6 +626,24 @@ smoke test.
   Secure Boot on targets. Until then the loud unsigned warning must stay.
   **Key generation + enrolment procedure: [secure-boot-keys.md](secure-boot-keys.md)**
   (the PK/KEK/db trio; `db` = `sb_key`/`sb_cert`, PK/KEK stay offline).
+- **PXE-only iPXE fallback — BENCH-VERIFIED on the EliteBook 820 G4 (2026-06-20).**
+  Firmware without UEFI HTTP boot chainloads `serving/tftp/snponly.efi` → renders
+  `autoexec.ipxe` (ifopen + DHCP-retry + `imgargs <real cmdline>`) → UKI over HTTP
+  → NVMe/verity root. dnsmasq tags `pxe`/`ipxe`/`httpboot` give graceful per-client
+  fallback; HTTP-boot hosts are unaffected (firmware → UKI direct). Gotchas that
+  cost real time (all captured in [../serving/tftp/README.md](../serving/tftp/README.md)):
+  (i) the I219-LM needs **`snponly.efi`** (native iPXE driver won't bind);
+  (ii) **PortFast/edge on the switch port is REQUIRED** — iPXE's PHY bounce
+  triggers STP forwarding delay that drops DHCP (this was the real blocker);
+  (iii) iPXE aborts the script on any unguarded command failure (use `||`);
+  (iv) Secure Boot OFF makes systemd-stub take iPXE's load options as the cmdline,
+  so the entrypoint extracts the UKI's real `.cmdline` and feeds it via `imgargs`.
+- **Sign iPXE for the PXE-only fallback (Secure Boot, production).** The lab
+  `snponly.efi` is **UNSIGNED** → that path needs **Secure Boot OFF**. For
+  production: `sbsign` the iPXE binary with the fleet **db** key (only `db` needed —
+  no MS CA / shim), so SB stays enforced firmware → iPXE → UKI; then the cmdline
+  contraption becomes a no-op (the stub ignores loader cmdline under SB). See
+  [secure-boot-keys.md](secure-boot-keys.md) "PXE-only hosts".
 - **Bench-verify on the secure path** (swtpm + hostapd + FreeRADIUS,
   `disable_dot1x=false`) — the items deferred this session:
   - NM port secure path: `en*` UNMANAGED + `macsec0` MANAGED/renewing, MKA