fwupd stopped honouring the FWUPD_EFIAPPDIR environment variable in
https://github.com/fwupd/fwupd/pull/9846; the location is a compile-time
constant (`EFI_APP_LOCATION`) since then, so setting the variable on
fwupd.service had no effect.
Drop `RuntimeDirectory` from the signing unit too: the directory is now
created and populated by the fwupd module, and RuntimeDirectoryPreserve
defaults to `no`, so systemd removed it (together with the unsigned app)
whenever the unit stopped -- which `partOf = fwupd.service` makes happen
on every fwupd restart.
Cover the whole path in the limine secure boot test, which so far never
enabled fwupd: it now asserts that both the unsigned app and the signed
variant end up in /run/fwupd-efi.
Assisted-by: claude-code with claude-opus-5[1m]-high
There is not reason to build an extra variant of OVMF only to get Secure
Boot support. We can just use the already built OVMFFull. Since
useSecureBoot is now no-op, it is also removed.
An easier way to check if secureBoot is enabled is by running mokutil --sb-state
We have to do this way now because on systemd v258 `bootctl status` returns non 0 value if systemd-boot is not properly installed, which is to be expected when using Limine.
