pxe: mask serial-getty@ttyS0 so hosts without serial don't wait 90s

systemd-getty-generator reads console=ttyS0 off the kernel cmdline and
auto-creates serial-getty@ttyS0.service, which BindsTo dev-ttyS0.device.
On hardware without a physical serial port the device node never shows
up, systemd waits its full default 90s timeout, and only then proceeds.

systemd.mask= on the kernel cmdline is a first-class option — masks
the unit before the generator's link even gets activated. Kernel
messages still go to ttyS0 if a port is present; we just don't try
to spawn a login prompt there.

internal/pxe/ipxe.go

@@ -49,6 +49,13 @@ func BuildScript(p IPXEParams) string {
 		"systemd.log_level=info",
 		"systemd.log_target=kmsg",
 		"systemd.journald.forward_to_console=1",
+		// systemd-getty-generator sees console=ttyS0 and creates
+		// serial-getty@ttyS0.service, which waits up to 90s for
+		// /dev/ttyS0 to appear. Hosts without a serial port time
+		// out and delay boot. Mask the getty — kernel logs still
+		// tee to ttyS0 if the port exists, we just don't spawn
+		// a login prompt there.
+		"systemd.mask=serial-getty@ttyS0.service",
 	)
 
 	var b strings.Builder