contrib/surface: add Surface Laptop 7 arm64/Snapdragon X Elite bootc example (upstream kernel, NX Mode SB workaround)

[corning-croak-cable]

Surface Laptop 7 - Snapdragon X Elite (aarch64) bootc example (contrib)

Adds example Containerfile and supporting config for building a bootc-compatible
OCI image for the Microsoft Surface Laptop 7 with Snapdragon X Elite (x1e80100, aarch64).

Priorities: bootable images first, upstream kernel only, TPM/Secure Boot enrollment quirks resolved.

Files (contrib/surface/arm64/)

contrib/surface/arm64/
  Containerfile.fedora                           # Fedora rawhide aarch64 (upstream kernel)
  usr/lib/bootc/install/50-surface-arm64.toml   # install config: no tpm2-luks (fTPM quirk)
  usr/lib/bootc/kargs.d/50-surface-arm64.toml   # persistent kargs (clk/pd_ignore_unused)
  usr/lib/modprobe.d/surface-arm64.conf          # tpm_crb forced, tpm_tis blacklisted, qrtr tuning
  usr/lib/systemd/sleep.conf.d/surface-arm64.conf   # s2idle/freeze only (no S3 on Snapdragon)
  usr/lib/systemd/system/qrtr-ns.service         # Qualcomm IPC Router Namespace daemon
  usr/lib/systemd/system/pd-mapper.service       # Qualcomm Protection Domain Mapper
  usr/lib/systemd/system/surface-sb-enroll.service  # firstboot SB enrollment (NX Mode workaround)
  usr/lib/surface/sb-enroll.sh                   # sbctl key gen + UEFI enrollment guide
  usr/lib/systemd/system-preset/15-surface-arm64.preset
  README.md

Design decisions (source-grounded)

1. Upstream kernel (no linux-surface)

x1e80100-microsoft-romulus13/15.dts device trees are merged upstream since kernel 6.12.
Fedora rawhide aarch64 ships them in kernel-core. linux-surface provides no aarch64 packages.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/arm64/boot/dts/qcom/x1e80100-microsoft-romulus13.dts

2. block = ["direct"] (no tpm2-luks)

Qualcomm fTPM on X Elite is not available during the initrd phase when
systemd-cryptenroll attempts TPM2 PCR enrollment. This causes tpm2-luks install to fail.

Verified from config.rs: block field filters allowed BlockSetup variants.
By including only direct, callers cannot accidentally select tpm2-luks for this platform.

Source: community testing, linux-surface/linux-surface#1590

3. No MokManager - sbctl firstboot + direct UEFI db enrollment

Surface UEFI enforces NX (No-Execute) mode. MokManager freezes (black screen at logo)
when Secure Boot key enrollment is triggered via shim.

bootc already uses UKI + systemd-boot without shim, so MokManager is irrelevant.
The surface-sb-enroll.service firstboot unit generates keys via sbctl, signs all UKIs,
and writes step-by-step instructions for direct UEFI db enrollment.

Source: linux-surface/linux-surface#1590

4. SuspendState=freeze (s2idle only)

Snapdragon X Elite PSCI/ACPI on Linux exposes only s2idle; S3 is not available.

Build and install

# Build (native aarch64 or cross from x86-64 with qemu-user-static)
podman build --platform linux/arm64 -f contrib/surface/arm64/Containerfile.fedora -t surface-arm64 .

# Install to disk (Secure Boot disabled in Surface UEFI first)
podman run --rm --privileged --pid=host -v /dev:/dev surface-arm64 bootc install to-disk /dev/nvme0n1

# First boot: check enrollment instructions
cat /var/lib/surface-sb-enroll/ENROLL_SECURE_BOOT.md