Simplify secure boot implementation using modern libvirt

Replace hardcoded firmware paths with modern libvirt approach using
just `<loader secure="yes"/>` inside `<os firmware="efi">`. This lets
libvirt automatically handle firmware path detection across different
distributions.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

Author: cgwalters

crates/kit/src/libvirt/domain.rs

@@ -196,41 +196,8 @@ impl DomainBuilder {
         )?;
 
         if use_uefi && secure_boot {
-            // Secure boot requires explicit firmware paths
-            // NOTE: These paths are currently hardcoded for Fedora/RHEL systems.
-            // Different distributions may use different paths. In the future, this
-            // should be made configurable or detected at runtime.
-            // Define architecture-specific firmware paths
-            let (code_path, nvram_template) = match arch_config.arch {
-                "x86_64" => (
-                    "/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd",
-                    "/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd",
-                ),
-                "aarch64" => (
-                    "/usr/share/edk2/aarch64/QEMU_EFI.fd",
-                    "/usr/share/edk2/aarch64/QEMU_VARS.fd",
-                ),
-                _ => {
-                    return Err(eyre!(
-                        "Secure boot not supported for architecture: {}",
-                        arch_config.arch
-                    ));
-                }
-            };
-
-            writer.write_text_element_with_attrs(
-                "loader",
-                code_path,
-                &[("readonly", "yes"), ("type", "pflash"), ("secure", "yes")],
-            )?;
-
-            // Generate per-domain NVRAM path
-            let nvram_path = format!("/var/lib/libvirt/qemu/nvram/{}_VARS.fd", &name);
-            writer.write_text_element_with_attrs(
-                "nvram",
-                &nvram_path,
-                &[("template", nvram_template)],
-            )?;
+            // Modern libvirt handles firmware paths automatically for secure boot
+            writer.write_empty_element("loader", &[("secure", "yes")])?;
         }
 
         writer.write_empty_element("boot", &[("dev", "hd")])?;
@@ -513,35 +480,14 @@ mod tests {
             .with_name("test-secure-boot")
             .with_firmware("uefi-secure");
 
-        let arch = std::env::consts::ARCH;
-        match arch {
-            "x86_64" | "aarch64" => {
-                let xml = builder.build_xml().unwrap();
-                // Should include explicit loader and nvram configuration
-                assert!(xml.contains("loader"));
-                assert!(xml.contains("nvram"));
-                assert!(xml.contains("secure=\"yes\""));
-                assert!(xml.contains("template="));
-
-                // Should include secure boot firmware paths based on architecture
-                if arch == "x86_64" {
-                    assert!(xml.contains("/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd"));
-                    assert!(xml.contains("/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd"));
-                } else {
-                    assert!(xml.contains("/usr/share/edk2/aarch64/QEMU_EFI.fd"));
-                    assert!(xml.contains("/usr/share/edk2/aarch64/QEMU_VARS.fd"));
-                }
-            }
-            _ => {
-                // For unsupported architectures, build should fail.
-                let result = builder.build_xml();
-                assert!(result.is_err());
-                assert!(result
-                    .unwrap_err()
-                    .to_string()
-                    .contains("Secure boot not supported"));
-            }
-        }
+        let xml = builder.build_xml().unwrap();
+        
+        // Should include secure boot loader configuration
+        assert!(xml.contains("loader"));
+        assert!(xml.contains("secure=\"yes\""));
+        
+        // Should use firmware="efi" for UEFI
+        assert!(xml.contains("firmware=\"efi\""));
 
         // Test regular UEFI without secure boot
         let xml_regular = DomainBuilder::new()
@@ -553,7 +499,6 @@ mod tests {
         // Should use libvirt auto firmware selection
         assert!(xml_regular.contains("firmware=\"efi\""));
         assert!(!xml_regular.contains("secure=\"yes\""));
-        assert!(!xml_regular.contains("template="));
 
         // Test BIOS firmware (no secure boot)
         let xml_bios = DomainBuilder::new()