On the Secure Boot lab VM, GRUB's "exit" back to the firmware did not reach the disk: OVMF went on to its other network boot options and stopped in its own boot menu. The local-disk entry now finds the installed OS's signed loader on the EFI partition (shimx64.efi under EFI/debian, ubuntu, rocky, almalinux, redhat, centos; shim.efi for SUSE; else EFI/BOOT/BOOTX64.EFI) and chainloads it, as MAAS does. build-image.sh writes SHA256SUMS next to the image (the old one was stale after a rebuild; bootstrap.sh --image-url checks it). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>