Add post-build UKI verification gate before EFI registration

[GlitchSlayed]

Motivation

• Ensure the generated uki-build.sh template performs a safety/consistency check on the built UKI prior to creating UEFI boot entries to avoid registering broken images.
• Provide deterministic checks for artifact presence, format, metadata, and an audit record for each produced UKI.

Description

• Add file to the setup dependency list and ensure the generated build script requires file and objdump at runtime via require_cmd.
• Insert a post-build verification stage in the generated uki-build.sh template that runs before EFI registration and enforces: existence/non-empty artifact, minimum size threshold (10 MiB), PE/COFF detection via file and objdump -f, extraction/validation of embedded cmdline (via ukify inspect with .cmdline objdump fallback) and uname metadata (via ukify inspect with .uname objdump fallback), and only proceeds to EFI registration when all checks pass.
• Compute and append a SHA256 audit line for each written UKI to /var/log/uki-setup.log with UTC timestamp and the kernel version.
• Add helper functions extract_uki_section_text, extract_ukify_inspect_field, and verify_uki_post_build into the generated script and wire them into the build flow.
• Update tests/test_uki_setup.sh to assert the new verification-related template contents and required runtime checks are present.

Testing

• Ran the local unit script: bash tests/test_uki_setup.sh, which completed successfully and validated the generated uki-build.sh template contains the new verification functions, runtime require_cmd checks, and the /var/log/uki-setup.log audit path.

---

Codex Task