Signed USB Rescue Boot: aegis-boot and the QEMU+OVMF Persona Harness

A UEFI-Secure-Boot-preserving rescue USB for any ISO, and the companion QEMU harness that validates it against ~100 hardware personas without physical Frameworks, ThinkPads, or Dells on a lab bench.