fwupd is now built with `efi_app_location = /run/fwupd-efi` so that
setups signing their EFI binaries (lanzaboote, sbctl, ...) can place the
signed app next to the unsigned one, which is impossible inside the
read-only store.
Nothing created that directory yet, so copy the unsigned app there from
`fwupd.fwupd-efi`. `C+` merges into an existing directory without
replacing files, so signed variants written by a bootloader module are
kept; the copy is refreshed whenever the rule (and thus the fwupd-efi
store path) changes.
Assisted-by: claude-code with claude-opus-5[1m]-high
eeff298718