[FIX] script qemu: disable UEFI Secure Boot (Arch boot)

OVMF Secure Boot rejected Arch's unsigned GRUB with "Access Denied" ->
"No bootable option" -> dropped to the firmware menu, never booted.
Disable Secure Boot in the UEFI boot (firmware.feature secure-boot=no):
Arch now boots and cloud-init applies user/password/hostname/ssh-key
(console login erplibre/erplibre works). Ubuntu/Debian/Fedora also boot
without Secure Boot (their signed shim is not required), no regression.

Note: Arch networking (eth0 stays down, cloud-init does not finish) is
still under investigation and tracked separately.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

script/qemu/deploy_qemu.py

@@ -1001,8 +1001,15 @@ def virt_install(
     # n'embarquent plus le chargeur BIOS/GRUB-pc et partent en boucle
     # « Booting... » en SeaBIOS. UEFI (OVMF) fonctionne pour Ubuntu/Debian/
     # Fedora. --bios force l'ancien BIOS si OVMF est indisponible.
+    # Secure Boot DÉSACTIVÉ : le chargeur d'Arch (GRUB) n'est pas signé et
+    # OVMF Secure Boot le refuse (« Access Denied » -> pas de boot). Ubuntu/
+    # Debian/Fedora bootent aussi sans Secure Boot (shim signé non requis).
     if not args.bios:
-        cmd += ["--boot", "uefi"]
+        cmd += [
+            "--boot",
+            "uefi,firmware.feature0.name=secure-boot,"
+            "firmware.feature0.enabled=no",
+        ]
     if not args.attach_console:
         cmd.append("--noautoconsole")
     runner.run(cmd, privileged=True)