Document ARM64 zstd EFI zboot blocker and update VM test skip messages

[foil-copy-overrate]

Motivation

• Investigate and document the ARM64 EFI zboot + zstd DirectBoot failure observed when bcvk/QEMU attempts to unpack EFI zboot images, since this host-side loader incompatibility causes CI VM boots to fail before guest tests run.
• Make the VM e2e tests robust and actionable by turning the exact DirectBoot/zstd failure into a prescriptive skip that points maintainers to remediation options instead of producing noisy failures.

Description

• Added refs/zstd-efi-zboot-bcvk.md containing research, reproduction context, relevant source links, and recommended tactical/strategic fixes for the zstd EFI zboot blocker.
• Updated tests/vm/test-luks-fido2-ci.sh to replace the generic skip message with a prescriptive message referencing bcvk/QEMU, remediation options, and the new refs/zstd-efi-zboot-bcvk.md doc.
• Updated tests/vm/test-fido2-enrollment.sh to match the same prescriptive skip message and reference the research doc.
• Updated TODO.md to reference the new research note and record the preferred resolution path for the blocker.

Testing

• Ran bash -n tests/vm/test-luks-fido2-ci.sh tests/vm/test-fido2-enrollment.sh and the syntax check succeeded.
• Attempted shellcheck tests/vm/test-luks-fido2-ci.sh tests/vm/test-fido2-enrollment.sh but shellcheck was not available in the environment, so that check was not run.
• No other automated test failures were introduced by these documentation and message changes.

---

Codex Task