Menu: Clonezilla boots with Secure Boot on (Debian shim); Memtest86+ removed

Clonezilla Live runs a Debian-signed kernel whose modules (usb-storage,
uas, exfat) are signed by the same build key, so the menu now starts it
through Debian's Microsoft-signed shim with the iPXE shim command, the
same way Blancco uses Ubuntu's. prepare-boot-tools.sh extracts that shim
from the Clonezilla release (EFI/boot/bootx64.efi -> clonezilla/
shimx64.efi) and warns when the shim is not Microsoft-signed or the
kernel not Debian-signed.

Memtest86+ is unsigned and needed Secure Boot off; memory tests now use
the Dell built-in diagnostics (F12 at power-on, Diagnostics), noted in
the menu. The playbook removes the old memtest web dir. Nothing on the
menu needs Secure Boot off any more; the 'disable Secure Boot' screen
remains only as the fallback when a signed path fails.

playbook/pxe_server_setup.yml

@@ -699,7 +699,11 @@
       loop:
         - clonezilla
         - blancco
-        - memtest
+
+    - name: "Remove the retired Memtest86+ web dir (memory tests: Dell F12 Diagnostics)"
+      file:
+        path: "{{ web_root }}/memtest"
+        state: absent
 
     - name: "Menu: the Blancco file names in the menu must match blancco_kver"
       # GetPxeScript.aspx names the UEFI Blancco files by suffix
@@ -1378,13 +1382,14 @@
       debug:
         msg: "{{ ipxe_chain.stdout }}"
 
-    - name: "Copy boot tool files from USB (Clonezilla, Blancco, Memtest)"
+    - name: "Copy boot tool files from USB (Clonezilla, Blancco)"
+      # Clonezilla includes shimx64.efi (Debian's Microsoft-signed shim), which
+      # the menu uses to boot its Debian-signed kernel with Secure Boot on.
       shell: >
         cp -r "{{ usb_root }}/boot-tools/{{ item }}/"* "{{ web_root }}/{{ item }}/" 2>/dev/null || true
       loop:
         - clonezilla
         - blancco
-        - memtest
 
     # --- Blancco PXE boot via Ubuntu kernel + switch_root ---
     # Blancco's own kernel freezes on Dell Precision towers. Workaround: