Add a new script that prepares FWS to boot signed under Secure Boot without enabling kernel lockdown, preserving hibernation capability.
The script:
- Checks UEFI firmware availability
- Installs sbctl if needed
- Locates ESP and GRUB EFI binary
- Reinstalls GRUB with SBAT section if missing
- Creates and enrolls sbctl keys while preserving Microsoft keys
- Signs GRUB and available kernel images
- Provides instructions for manual firmware setup steps
- Enables automatic re-signing after kernel/GRUB updates via pacman hooks
This allows FWS to meet Vanguard's Secure Boot requirement without sacrificing hibernation support.
