v0.6.1: latest iPXE + automatic NIC driver fallback (more devices, zero toggle)

Mirrors the worthwhile device-support wins from iVentoy 1.0.24→1.0.35 onto our
(very different) proxy-DHCP + iPXE-chainload architecture. iVentoy's other
changes are inapplicable (arm64-server / distro-display fixes live in its
injected Linux, which we don't have), niche (iSCSI), or closed-source
(Matrix Boot).

iPXE refreshed (mirrors 1.0.35 "Update iPXE")
- Pin the from-source build to ipxe/ipxe master @ 2026-06-09
  (95ffbf4745553e8a207922389929e1943c0237c0) — newer NIC drivers + EFI fixes.
  The pin also busts the cached ipxe-build Docker layer so the release
  actually recompiles iPXE; build-ipxe.sh now shallow-fetches an exact SHA.

Automatic NIC driver fallback (mirrors 1.0.34 "driver/boot-file mode" — but
no operator toggle, per request)
- New DriverMode {Firmware, Builtin} in core; ClientArch::ipxe_bootfile_mode
  maps each arch to either the firmware-net build (snponly/undionly, default)
  or the all-drivers build (ipxe.efi/ipxe.pxe/ipxe-i386.efi/ipxe-arm64.efi).
- The DHCP proxy serves Firmware by default — byte-for-byte unchanged, so
  hardware that boots today never regresses. A new DriverEscalation state
  machine watches for the tell-tale failure: a MAC re-PXE-boots (fresh
  firmware DISCOVER) without ever completing the iPXE-user-class handoff that
  proves the firmware NIC stack worked. That MAC is automatically escalated to
  iPXE's own NIC drivers, and the choice is sticky after a confirmed handoff
  (debounced for the :67/:4011 same-boot pair, TTL-pruned, capped). It just
  works — no settings, no UI.
- All-drivers binaries fetched per arch (ipxe.pxe + i386/arm64 native EFI;
  x86_64 ipxe.efi already built from source with PNG); ipxe-assets embeds
  *.pxe and logs availability per (arch, mode).

Core principles intact: DHCP-proxy-only, container-first, Rust-focused (the
logic is all Rust; only the iPXE fetch/build stays shell), Windows hard-rules
untouched (this never goes near Windows boot).

Validation: clippy clean; full workspace test suite green (core 99 incl. new
DriverMode tests, dhcp-proxy +4 escalation tests, http-api 31+68, iso-store
61, tftp 6, bin 2); fmt-clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

scripts/build-ipxe.sh

@@ -41,15 +41,31 @@ DEST="${1:-$ROOT/assets/ipxe}"
 WORK="$(mktemp -d)"
 trap 'rm -rf "$WORK"' EXIT
 
-# Pinned upstream iPXE. Rolling master is fine functionally, but a pin
-# keeps builds reproducible and protects against a transient master
-# breakage. Bump deliberately.
+# Pinned upstream iPXE. Rolling master is fine functionally, but a pin keeps
+# builds reproducible, protects against a transient master breakage, and —
+# crucially for the Docker image — busting this value invalidates the cached
+# ipxe-build layer so an "update iPXE" release actually recompiles from the
+# new upstream. Bump deliberately to a recent master commit.
+#
+# v0.6.1: ipxe/ipxe master @ 2026-06-09 (newer NIC drivers + EFI fixes;
+# mirrors iVentoy 1.0.35 "Update iPXE").
 IPXE_REPO="https://github.com/ipxe/ipxe.git"
-IPXE_REF="${IPXE_REF:-master}"
+IPXE_REF="${IPXE_REF:-95ffbf4745553e8a207922389929e1943c0237c0}"
 
-echo ">> cloning iPXE ($IPXE_REF)"
-git clone --depth 1 --branch "$IPXE_REF" "$IPXE_REPO" "$WORK/ipxe" 2>/dev/null \
-  || git clone "$IPXE_REPO" "$WORK/ipxe"
+echo ">> fetching iPXE ($IPXE_REF)"
+# Shallow-fetch the exact ref: works for a full commit SHA (GitHub allows
+# reachable-SHA1-in-want) and for branch/tag names. Fall back to a full
+# clone + checkout if the server refuses a direct fetch of this ref.
+git init -q "$WORK/ipxe"
+git -C "$WORK/ipxe" remote add origin "$IPXE_REPO"
+if git -C "$WORK/ipxe" fetch -q --depth 1 origin "$IPXE_REF"; then
+  git -C "$WORK/ipxe" checkout -q FETCH_HEAD
+else
+  echo "   direct fetch failed; falling back to full clone + checkout"
+  rm -rf "$WORK/ipxe"
+  git clone -q "$IPXE_REPO" "$WORK/ipxe"
+  git -C "$WORK/ipxe" checkout -q "$IPXE_REF"
+fi
 SRC="$WORK/ipxe/src"
 
 echo ">> applying OpenPXE config overrides (PNG + framebuffer + console cmd)"

scripts/fetch-ipxe.sh

@@ -29,11 +29,19 @@ mkdir -p "$DEST"
 # Upstream uses arch-scoped subdirectories; we flatten to the names our
 # ClientArch::ipxe_bootfile() expects.
 declare -a MAP=(
+  # DriverMode::Firmware (default) — reuse the firmware UNDI/SNP NIC stack.
   "undionly.kpxe=undionly.kpxe"
   "snponly.efi=x86_64-efi/snponly.efi"
   "snponly-i386.efi=i386-efi/snponly.efi"
   "snponly-arm64.efi=arm64-efi/snponly.efi"
-  "ipxe.efi=x86_64-efi/ipxe.efi"          # fallback with bundled drivers
+  # DriverMode::Builtin (v0.6.1 automatic fallback) — iPXE's own all-drivers
+  # builds, advertised by the DHCP proxy to a MAC whose firmware NIC stack
+  # failed to chainload. (x86_64 ipxe.efi is rebuilt from source with PNG in
+  # build-ipxe.sh and overlaid on top of this fetched baseline.)
+  "ipxe.efi=x86_64-efi/ipxe.efi"
+  "ipxe.pxe=ipxe.pxe"
+  "ipxe-i386.efi=i386-efi/ipxe.efi"
+  "ipxe-arm64.efi=arm64-efi/ipxe.efi"
 )
 
 BASE="https://boot.ipxe.org"