Menu: Clonezilla boots with Secure Boot on (Debian shim); Memtest86+ removed

Clonezilla Live runs a Debian-signed kernel whose modules (usb-storage,
uas, exfat) are signed by the same build key, so the menu now starts it
through Debian's Microsoft-signed shim with the iPXE shim command, the
same way Blancco uses Ubuntu's. prepare-boot-tools.sh extracts that shim
from the Clonezilla release (EFI/boot/bootx64.efi -> clonezilla/
shimx64.efi) and warns when the shim is not Microsoft-signed or the
kernel not Debian-signed.

Memtest86+ is unsigned and needed Secure Boot off; memory tests now use
the Dell built-in diagnostics (F12 at power-on, Diagnostics), noted in
the menu. The playbook removes the old memtest web dir. Nothing on the
menu needs Secure Boot off any more; the 'disable Secure Boot' screen
remains only as the fallback when a signed path fails.

SETUP.md

@@ -11,7 +11,7 @@ Client PXE boot
      ├── Windows PE -> wimboot -> boot.wim -> startnet.cmd -> Samba -> Image deployment
      ├── Clonezilla -> vmlinuz/initrd -> Disk cloning/imaging
      ├── Blancco    -> Native kernel + initramfs -> NIST 800-88 drive erasure (auto-reports)
-     └── Memtest86+ -> Memory diagnostics
+     (memory test: Dell F12 > Diagnostics)
 ```
 
 ### Services on the PXE Server
@@ -81,10 +81,10 @@ to `pip-wheels/`. About 500 debs (~1.6 GB) + 8 wheels.
 ### Step 2: Prepare Boot Tools (optional)
 
 ```bash
-./scripts/prepare-boot-tools.sh /path/to/blancco.iso /path/to/clonezilla.zip /path/to/memtest.bin
+./scripts/prepare-boot-tools.sh /path/to/blancco.iso
 ```
 
-Extracts boot files for Blancco, Clonezilla, and Memtest86+ into the `boot-tools/` directory. Automatically patches Blancco's `config.img` to auto-save erasure reports to the PXE server's Samba share.
+Extracts boot files for Blancco and Clonezilla (with Debian's signed shim, so it boots with Secure Boot on) into the `boot-tools/` directory. Automatically patches Blancco's `config.img` to auto-save erasure reports to the PXE server's Samba share.
 
 ### Step 3: Build the USB
 
@@ -175,7 +175,7 @@ Access at `http://172.16.9.1:9009` from any machine on the isolated network.
    - **Windows PE**: Boots via wimboot + boot.wim, maps Samba shares, begins deployment
    - **Clonezilla**: Boots Clonezilla Live for disk imaging
    - **Blancco**: Boots Drive Eraser, auto-saves reports to server
-   - **Memtest86+**: Runs memory diagnostics
+   - **Memory test**: not on the menu; Dell PCs have one built in (F12 at power-on, Diagnostics)
 
 ## Testing with KVM
 
@@ -221,8 +221,7 @@ pxe-server/
 │   └── shopfloor-display-imaging-guide.md  # End-user imaging guide
 ├── boot-tools/                   # Extracted boot files (gitignored, built by prepare-boot-tools.sh)
 │   ├── blancco/                  # Blancco Drive Eraser
-│   ├── clonezilla/               # Clonezilla Live
-│   └── memtest/                  # Memtest86+
+│   └── clonezilla/               # Clonezilla Live
 ├── boot-files/                   # WinPE boot files (boot.wim, wimboot, ipxe.efi, BCD)
 ├── offline-packages/             # .deb files (gitignored, built by download-packages.sh)
 ├── pip-wheels/                   # Python wheels (gitignored, built by download-packages.sh)