Switch from sanboot to kernel/initrd boot with PXE overlay for ISO download

sanboot makes the ISO visible to UEFI but invisible to the Linux kernel
after ExitBootServices(). Switch to direct kernel/initrd boot with a small
CPIO overlay containing /pxe-init — a shell script that loads NIC drivers,
configures DHCP, downloads the ISO via wget, and creates a loop device
before handing off to the Proxmox installer init.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/image/service.go

@@ -55,12 +55,13 @@ func (s *Service) Upload(ctx context.Context, p UploadParams) (*model.Image, err
 		return nil, fmt.Errorf("extract ISO: %w", err)
 	}
 
-	if s.PublicURL != "" {
-		report := func(stage, detail string) {
-			if p.OnProgress != nil {
-				p.OnProgress(stage, detail)
-			}
+	report := func(stage, detail string) {
+		if p.OnProgress != nil {
+			p.OnProgress(stage, detail)
 		}
+	}
+
+	if s.PublicURL != "" {
 		report("packaging", "Configuring ISO for automated installation...")
 		isoFile := filepath.Join(destDir, result.ISOFilename)
 		answerURL := s.PublicURL + "/api/boot/auto-answer"
@@ -69,6 +70,12 @@ func (s *Service) Upload(ctx context.Context, p UploadParams) (*model.Image, err
 		}
 	}
 
+	report("packaging", "Creating PXE boot overlay...")
+	overlayPath := filepath.Join(destDir, "pxe-overlay.img")
+	if err := CreatePXEOverlay(overlayPath); err != nil {
+		log.Printf("image: PXE overlay creation failed (non-fatal): %v", err)
+	}
+
 	kernelPath := filepath.Join(p.Name, result.KernelFilename)
 	initrdPath := filepath.Join(p.Name, result.InitrdFilename)
 	isoPath := filepath.Join(p.Name, result.ISOFilename)