Move autoexec.ipxe to ipxe root and remove secureboot dirs before checksums

After ISO/USB images are generated from the secureboot directories,
move autoexec.ipxe to the ipxe root as a standalone file and remove
the secureboot directories. This means:
- Checksums are generated cleanly with no secureboot-* subdirectory entries
- autoexec.ipxe is checksummed automatically as a regular ipxe/ file
- build_release needs no special handling for secureboot directories
- autoexec.ipxe flows naturally into both githubout (release asset)
  and s3out (CDN) through the existing copy logic

roles/netbootxyz/tasks/generate_disks_secureboot.yml

@@ -97,6 +97,20 @@
     chdir: "{{ ipxe_source_dir }}/src"
   when: generate_disks_arm | default(false) | bool
 
+- name: Copy autoexec.ipxe to ipxe root as standalone release asset
+  ansible.builtin.copy:
+    src: "{{ netbootxyz_root }}/ipxe/secureboot-x86_64/autoexec.ipxe"
+    dest: "{{ netbootxyz_root }}/ipxe/autoexec.ipxe"
+    remote_src: true
+
+- name: Remove Secure Boot directories after ISO/USB generation
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: absent
+  with_items:
+    - "{{ netbootxyz_root }}/ipxe/secureboot-x86_64"
+    - "{{ netbootxyz_root }}/ipxe/secureboot-arm64"
+
 - name: Clean up Secure Boot archive
   ansible.builtin.file:
     path: "{{ item }}"

script/build_release

@@ -48,24 +48,6 @@ if ! [[ "${TYPE}" == "rolling" ]]; then
   cp buildout/version.ipxe s3outver/
   mkdir -p githubout
   mv buildout/ipxe/* githubout/
-  # Extract autoexec.ipxe as a standalone release asset for Secure Boot.
-  # The signed iPXE binaries are consumed directly from the upstream iPXE
-  # release (ipxeboot.tar.gz) to preserve provenance; netboot.xyz only
-  # ships the boot script that chains into the menu system.
-  if [[ -f "githubout/secureboot-x86_64/autoexec.ipxe" ]]; then
-    cp githubout/secureboot-x86_64/autoexec.ipxe githubout/autoexec.ipxe
-    cp githubout/secureboot-x86_64/autoexec.ipxe s3out/autoexec.ipxe
-  fi
-  # Remove secureboot directories from githubout since the signed binaries
-  # are not re-distributed as netboot.xyz release assets
-  rm -rf githubout/secureboot-x86_64 githubout/secureboot-arm64
-  # Update checksums: remove stale secureboot-* entries, add autoexec.ipxe
-  if [[ -f githubout/*-sha256-checksums.txt ]]; then
-    sed -i '/secureboot-/d' githubout/*-sha256-checksums.txt
-    if [[ -f githubout/autoexec.ipxe ]]; then
-      (cd githubout && sha256sum autoexec.ipxe >> *-sha256-checksums.txt)
-    fi
-  fi
   cd buildout
   rm -Rf ipxe
   tar -czf menus.tar.gz *