[post-launch] chipsec first-boot validation as portable service (ADR-010)

[foil-copy-overrate]

Post-launch research / implementation item. See ADR-010 (DPS over /etc/fstab).

Run chipsec at first boot to detect Absolute Persistence (Computrace) in the PCR event log and other firmware-level anomalies. Package as a DPS-compliant portable service (RootImage=, Verity+PKCS#7 signed GPT image) so it doesn't touch the immutable /usr.

Actions:

• Research chipsec portable service packaging
• Build chipsec GPT image with Verity+PKCS#7 signature
• Run at first boot; report results to journal
• Gate yubiOS-enroll.service on clean chipsec result (or warn)

ADR: ADR-010

[foil-copy-overrate]

⏳ Post-launch — deferred. Reference: ADR-010, FUTURE.md. Package as DPS-compliant portable service (RootImage=, Verity+PKCS#7 signed GPT image).