Menu: Clonezilla boots with Secure Boot on (Debian shim); Memtest86+ removed

Clonezilla Live runs a Debian-signed kernel whose modules (usb-storage,
uas, exfat) are signed by the same build key, so the menu now starts it
through Debian's Microsoft-signed shim with the iPXE shim command, the
same way Blancco uses Ubuntu's. prepare-boot-tools.sh extracts that shim
from the Clonezilla release (EFI/boot/bootx64.efi -> clonezilla/
shimx64.efi) and warns when the shim is not Microsoft-signed or the
kernel not Debian-signed.

Memtest86+ is unsigned and needed Secure Boot off; memory tests now use
the Dell built-in diagnostics (F12 at power-on, Diagnostics), noted in
the menu. The playbook removes the old memtest web dir. Nothing on the
menu needs Secure Boot off any more; the 'disable Secure Boot' screen
remains only as the fallback when a signed path fails.

scripts/build-usb.sh

@@ -677,7 +677,7 @@ else
     echo "    WARNING: No boot-files/ found (copy WinPE boot files from Media Creator)"
 fi
 
-# Copy boot tools (Clonezilla, Blancco, Memtest) if prepared
+# Copy boot tools (Clonezilla, Blancco) if prepared
 if [ -n "$BOOT_TOOLS_DIR" ] && [ -d "$BOOT_TOOLS_DIR" ]; then
     t_cp "" "$BOOT_TOOLS_DIR"
     TOOLS_SIZE=$(du -shL "$BOOT_TOOLS_DIR" | cut -f1)