feat(pm/redhead): enable secure boot

I want to make booting not need a PIN/security key press, and therefore
I want to make sure that I'm booting only what is explicitly permitted.

Therefore, let's use lanzaboote! I've set it up before, so it's
relatively simple

packetmix/npins/sources.json

···
       "url": "https://github.com/nix-community/impermanence/archive/4b3e914cdf97a5b536a889e939fb2fd2b043a170.tar.gz",
       "hash": "sha256-LJggUHbpyeDvNagTUrdhe/pRVp4pnS6wVKALS782gRI="
     },
+    "lanzaboote": {
+      "type": "GitRelease",
+      "repository": {
+        "type": "GitHub",
+        "owner": "nix-community",
+        "repo": "lanzaboote"
+      },
+      "pre_releases": false,
+      "version_upper_bound": null,
+      "release_prefix": null,
+      "submodules": false,
+      "version": "v0.4.2",
+      "revision": "f0212638a2ec787a7841882f4477d40ae24f0a5d",
+      "url": "https://api.github.com/repos/nix-community/lanzaboote/tarball/refs/tags/v0.4.2",
+      "hash": "sha256-AEEDktApTEZ5PZXNDkry2YV2k6t0dTgLPEmAZbnigXU="
+    },
     "lix": {
       "type": "Git",
       "repository": {

packetmix/systems/redhead/lanzaboote.nix

···
+# SPDX-FileCopyrightText: 2025 FreshlyBakedCake
+#
+# SPDX-License-Identifier: MIT
+
+{
+  project,
+  pkgs,
+  lib,
+  ...
+}:
+{
+  imports = [ project.inputs.lanzaboote.result.nixosModules.lanzaboote ];
+
+  environment.systemPackages = [
+    pkgs.sbctl
+  ];
+
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+  boot.lanzaboote = {
+    enable = true;
+    pkiBundle = "/var/lib/sbctl";
+    publicKeyFile = "/secrets/lanzaboote/db/db.pem";
+    privateKeyFile = "/secrets/lanzaboote/db/db.key";
+  };
+
+  environment.etc."sbctl/sbctl.conf".text = builtins.toJSON {
+    keydir = "/secrets/lanzaboote";
+  };
+
+  clicks.storage.impermanence.persist.directories = [
+    "/var/lib/sbctl"
+  ];
+}