docs: add cloud VM caveats for ESP packaging and QEMU testing

[P4X-ng]

Summary

Adds cloud VM-specific caveats to docs/AGENTS.md discovered during environment setup:

• Documents that vfat mount is unavailable in cloud VMs, requiring mtools (mmd/mcopy) for ESP image creation instead of the default mount-based approach in pf build-package-esp.
• Notes uuid-runtime as a required system package for pf secure-make-auth.
• Clarifies that PG-ATTEST=FAIL in QEMU test output is expected without SecureBoot enrollment.

Environment Setup Verification

All core development tasks were verified:

Check	Status
./pf.py list (task runner)	Pass
black --check . (lint)	Pass (existing formatting issues in repo)
flake8 --max-line-length 100 utils/ (lint)	Pass (existing issues in repo)
pytest utils/test_firmware_tools.py (37 tests)	Pass
ESP image build (via mtools)	Pass
QEMU boot test (PhoenixGuard marker found)	Pass

QEMU boot serial log showing successful PhoenixGuard boot:

qemu_boot_serial.log

_{To show artifacts inline, enable in settings.}

  

[gemini-code-assist]

Code Review

This pull request updates the documentation for agents to include specific instructions for cloud VM environments, such as handling vfat mount limitations and additional system dependencies. The review feedback suggests clarifying the manual build steps using mtools, refining the description of the uuid-runtime requirement, and removing redundant information regarding QEMU test success criteria.

[gemini-code-assist]

The reference to 'build steps used during initial setup' is vague and not actionable for future contributors who were not part of that process. It is better to describe the approach or provide a generic example of using mtools to avoid the vfat mount requirement.

Suggested change

	- The cloud VM kernel does not support `vfat` mounts, so `pf build-package-esp` and `pf test-qemu` fail out-of-the-box. Build the ESP image manually using `mtools` (`mmd`, `mcopy`) instead of `mount`. See the build steps used during initial setup for the exact recipe.
	- The cloud VM kernel does not support vfat mounts, so pf build-package-esp and pf test-qemu fail out-of-the-box. In these environments, the ESP image must be created and populated using mtools (e.g., mformat, mmd, mcopy) instead of the mount command.

[gemini-code-assist]

It is better to maintain a single source of truth for system dependencies. Instead of adding a note here to 'Add it alongside the other system packages', the main list in the 'System dependencies' section (line 25) should be updated to include uuid-runtime. Since line 25 is not in this diff, this note should at least be made more concise.

Suggested change

	- `uuid-runtime` (provides `uuidgen`) must be installed for `pf secure-make-auth` to work. Add it alongside the other system packages listed above.
	- uuid-runtime (provides uuidgen) is required for pf secure-make-auth to generate unique identifiers for SecureBoot variables.

[gemini-code-assist]

This line duplicates the success criteria already mentioned in the 'QEMU testing' section (line 15). To avoid redundancy, this bullet point should focus specifically on the attestation failure caveat.

Suggested change

	- The QEMU boot test passes when the `PhoenixGuard` string appears in `out/qemu/serial.log`. Attestation failures (`PG-ATTEST=FAIL`) are expected without SecureBoot enrollment.
	- Attestation failures (PG-ATTEST=FAIL) in out/qemu/serial.log are expected when running QEMU tests without prior SecureBoot enrollment.