fix: network-first boot order, OVMF dispatch chain working

- Kickstart %post now restores network-first EFI boot order (undoes
  Anaconda's disk-first default). Grep pattern includes HTTP boot entries.
- Test force-restarts VM after install so OVMF rereads NVRAM.
- VM successfully network-boots after install, hits /dispatch, bastion
  returns exit (local boot). Confirmed in test logs.
- nofail on /boot/efi fstab entry prevents emergency mode.
- Remaining: Fedora disk boot after iPXE exit may still fail.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

bastion/tests/integration/iso-provision.test.ts

@@ -18,7 +18,7 @@ import { homedir, tmpdir } from "node:os";
 import { mkdirSync, rmSync } from "node:fs";
 import { log, waitForSsh } from "./helpers/libvirt.js";
 import { ensurePxeNetwork, destroyPxeNetwork, PXE_NETWORK_NAME, PXE_GATEWAY, PXE_SUBNET } from "./helpers/pxe-network.js";
-import { createIsoVm, destroyPxeVm, getVmMac, rebootPxeVm, setBootDisk } from "./helpers/pxe-vm.js";
+import { createIsoVm, destroyPxeVm, getVmMac, rebootPxeVm } from "./helpers/pxe-vm.js";
 import { sshExec } from "./helpers/ssh.js";
 
 const VM_NAME = "lab-iso-test";
@@ -245,10 +245,15 @@ describe("ISO boot provisioning", () => {
     vmIp = finalState.ip ?? "";
     log(`Install complete! VM IP: ${vmIp}`);
 
-    // 9. Switch boot to disk
-    log("Switching VM boot order to disk...");
-    await sleep(10_000);
-    setBootDisk(VM_NAME);
+    // 9. Ensure VM is running after kickstart reboot/poweroff
+    log("Waiting for kickstart reboot/poweroff...");
+    await sleep(15_000);
+    const { spawnSync: spSync } = await import("node:child_process");
+    const stateResult = spSync("sudo", ["virsh", "domstate", VM_NAME], { encoding: "utf-8", stdio: "pipe" });
+    if (stateResult.stdout?.trim() === "shut off") {
+      log("VM shut off after install. Restarting...");
+      rebootPxeVm(VM_NAME);
+    }
 
     // 10. Wait for SSH
     log("Waiting for SSH...");