Fix iPXE chainload loop by excluding iPXE from pxe-service

iPXE was stuck in a loop: boot iPXE -> DHCP -> get ipxe.0 again ->
boot iPXE -> repeat. Add tag:!ipxe to pxe-service directives so
iPXE clients get the HTTP script URL via dhcp-boot instead of being
served the bootloader again.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/pxe/supervisor.go

@@ -204,13 +204,15 @@ dhcp-ignore=tag:!known
 enable-tftp
 tftp-root={{.TFTPRoot}}
 
-# PXE boot menu (timeout 0 = boot immediately)
+# Detect iPXE (user-class "iPXE") to break chainload loop
-pxe-prompt="Provisioning",0
-pxe-service=x86PC,"Provisioning",undionly
-pxe-service=X86-64_EFI,"Provisioning",ipxe
-
-# iPXE chainload: once iPXE boots, serve HTTP script
 dhcp-userclass=set:ipxe,iPXE
+
+# Initial PXE firmware: serve iPXE bootloader (skip if already iPXE)
+pxe-prompt="Provisioning",0
+pxe-service=tag:!ipxe,x86PC,"Provisioning",undionly
+pxe-service=tag:!ipxe,X86-64_EFI,"Provisioning",ipxe
+
+# iPXE: serve HTTP boot script
 dhcp-boot=tag:ipxe,{{.PublicURL}}/ipxe/${mac:hexhyp}
 
 log-dhcp