boot: disable canTouchEfiVariables due to corruption issue

This gave me a lot of panic and grief. JetKVM got NO monitor output
I was panicing and away from home. Was awful. After letting it sit off
for a few hours it fixed itself, inline with nvram state draining over
time.

AGENTS.md

@@ -12,8 +12,9 @@ agenix for secrets, lanzaboote for secure boot, and ZFS for data storage.
 - **RAM**: 64 GB DDR4, no swap
 - **Motherboard**: ASRock B550M Pro4
 - **Boot drive**: WD_BLACK SN770 1TB NVMe (f2fs: 20G /persistent, 911G /nix; root is tmpfs)
-- **SSD pool `tank`**: 4x 2TB SATA SSDs (raidz2, 7.27T raw, ~2.2T free) -- services, backups, music
+- **SSD pool `tank`**: 4x 2TB SATA SSDs (raidz2) -- services, backups, music, misc
-- **HDD pool `hdds`**: 4x 18TB Seagate Exos X18 (raidz1, 65.5T raw, ~17.9T free) -- torrents, monero
+- **HDD pool `hdds`**: 4x 18TB Seagate Exos X18 (raidz1)-- torrents
+    - Connected via esata to external enclosure
 - **USB**: 8GB VFAT drive mounted at /mnt/usb-secrets (agenix identity key)
 - **GPU**: Intel (integrated, xe driver) -- used for Jellyfin hardware transcoding
 - **NIC**: enp4s0 (static 192.168.1.50/24)

configuration.nix

@@ -129,7 +129,10 @@
 
     loader = {
       # Use the systemd-boot EFI boot loader.
-      efi.canTouchEfiVariables = true;
+      # Disabled: ASRock B550M Pro4 AMI UEFI hangs on POST when NixOS
+      # writes EFI variables (NVRAM corruption). Lanzaboote boot entries
+      # are discovered via BLS Type #2 on the ESP, so this is not needed.
+      efi.canTouchEfiVariables = false;
 
       # 1s timeout
       timeout = 1;

flake.lock

@@ -89,11 +89,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1773506317,
+        "lastModified": 1773889306,
-        "narHash": "sha256-qWKbLUJpavIpvOdX1fhHYm0WGerytFHRoh9lVck6Bh0=",
+        "narHash": "sha256-PAqwnsBSI9SVC2QugvQ3xeYCB0otOwCacB1ueQj2tgw=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "878ec37d6a8f52c6c801d0e2a2ad554c75b9353c",
+        "rev": "5ad85c82cc52264f4beddc934ba57f3789f28347",
         "type": "github"
       },
       "original": {
@@ -197,11 +197,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1773681845,
+        "lastModified": 1773963144,
-        "narHash": "sha256-o8hrZrigP0JYcwnglCp8Zi8jQafWsxbDtRRPzuVwFxY=",
+        "narHash": "sha256-WzBOBfSay3GYilUfKaUa1Mbf8/jtuAiJIedx7fWuIX4=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "0759e0e137305bc9d0c52c204c6d8dffe6f601a6",
+        "rev": "a91b3ea73a765614d90360580b689c48102d1d33",
         "type": "github"
       },
       "original": {
@@ -285,11 +285,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1773802295,
+        "lastModified": 1774060651,
-        "narHash": "sha256-luPLLgS8VR2fHo3xT04KbJm0RU2wep6SDh3smwF8e5E=",
+        "narHash": "sha256-sZiam+rmNcOZGnlbnqDD9oTwfMdQUM+uQmFqqSoe194=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "41870283e080c46a6d33b6c3b3923e90348254c3",
+        "rev": "46727bd27d32d63069ed26a690554373ae2b4702",
         "type": "github"
       },
       "original": {
@@ -300,11 +300,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1773533765,
+        "lastModified": 1774018263,
-        "narHash": "sha256-qonGfS2lzCgCl59Zl63jF6dIRRpvW3AJooBGMaXjHiY=",
+        "narHash": "sha256-HHYEwK1A22aSaxv2ibhMMkKvrDGKGlA/qObG4smrSqc=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "f8e82243fd601afb9f59ad230958bd073795cbfe",
+        "rev": "2d4b4717b2534fad5c715968c1cece04a172b365",
         "type": "github"
       },
       "original": {
@@ -316,11 +316,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1773814637,
+        "lastModified": 1773964973,
-        "narHash": "sha256-GNU+ooRmrHLfjlMsKdn0prEKVa0faVanm0jrgu1J/gY=",
+        "narHash": "sha256-NV/J+tTER0P5iJhUDL/8HO5MDjDceLQPRUYgdmy5wXw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "fea3b367d61c1a6592bc47c72f40a9f3e6a53e96",
+        "rev": "812b3986fd1568f7a858f97fcf425ad996ba7d25",
         "type": "github"
       },
       "original": {
@@ -472,11 +472,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1773702072,
+        "lastModified": 1773886077,
-        "narHash": "sha256-oBBOi77u+uUX47xdYmerpk0cRXVlYOPR1+LsTidFvzg=",
+        "narHash": "sha256-A6jO6OEESZJ0+44Z0LmhnUi32VRfb8rdg/ralEamWDU=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "6810cbd27b8e9eac561997ee98cf30844c4ed282",
+        "rev": "cb48be23fc3d90cdd5a4ab6a27a7536481a4cf63",
         "type": "github"
       },
       "original": {
@@ -548,11 +548,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1773788980,
+        "lastModified": 1774048185,
-        "narHash": "sha256-CuD+g/MNgcAlbZ2OXZUzZfPHwXzzKM8qovdkIVhHy+A=",
+        "narHash": "sha256-OGKxauB88rUdPv9ByZlY2M1H0iFMerg3Ln4vXx8u0Iw=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "03ae4d7ea81606a88aee4bef8683d61c288763f9",
+        "rev": "307ae67495ad02871c8e5add41fd9e7b85fec167",
         "type": "github"
       },
       "original": {