dstack-mr: derive bootorder fw_cfg digest from the linuxboot ROM path

OVMF's `EV_PLATFORM_CONFIG_FLAGS` event for the `bootorder` fw_cfg key
hashes the raw fw_cfg blob (verified in
OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgCacheInit.c:208-228:
TpmMeasureAndLogData hashes ItemData, the fw_cfg buffer).

QEMU produces that blob in hw/i386/x86.c::x86_load_linux when `-kernel`
is in use: it appends a single option ROM (`linuxboot.bin` or
`linuxboot_dma.bin`, depending on whether fw_cfg DMA is enabled) with
`bootindex = 0`. dstack-vmm always uses q35, which enables fw_cfg DMA,
so the DMA variant ROM is used. No other dstack device gets an implicit
bootindex.

Confirmed by gdb-attaching the live dstack510 QEMU and calling
get_boot_devices_list() — it returned exactly
`/rom@genroms/linuxboot_dma.bin\0` (31 bytes), and sha384 of those bytes
equals the digest we'd captured before.

Replaces the previously-hardcoded `bootorder_fwcfg_hash` with that
derivation and removes the "if you change host_share_mode you must
recapture" warning — that condition isn't actually load-bearing for
this measurement.

Author: kvinwang

dstack-mr/src/tdvf.rs

@@ -346,14 +346,19 @@ impl<'a> Tdvf<'a> {
                 // menu=on`, so it defaults to 0x0000.
                 let bootmenu_fwcfg_hash = measure_sha384(&[0x00, 0x00]);
 
-                // fw_cfg `bootorder` is QEMU's generated bootorder string for
-                // the current device topology. dstack-vmm's QEMU command (9p +
-                // virtio-blk + vhost-vsock, no `-boot order=` / `bootindex=`)
-                // is fixed, so this is a constant. If the QEMU command line is
-                // ever changed (different host_share_mode, GPU passthrough,
-                // extra bootable devices) this digest will need re-capturing.
-                let bootorder_fwcfg_hash =
-                    hex!("53D3DBC00691328371E74C1B1C77BDF1BF4FF79DD1B55222B694FE8341CD8B0ADB3A9AB9286552C681272883B9B0FC1D");
+                // fw_cfg `bootorder` is the NUL-separated list of QEMU device
+                // paths whose backing devices have `bootindex` set. For
+                // `-kernel` boot, QEMU (hw/i386/x86.c::x86_load_linux) injects
+                // a single option ROM with `bootindex = 0`:
+                //   * `linuxboot_dma.bin`  if fw_cfg DMA is enabled (q35 default)
+                //   * `linuxboot.bin`      otherwise
+                // dstack-vmm always uses q35 → DMA is on → the bootorder file
+                // contains just the single path below (31 bytes, trailing
+                // NUL). No other dstack device gets an implicit bootindex.
+                //
+                // Verified end-to-end: gdb-attached the live QEMU and called
+                // get_boot_devices_list() — returned exactly these 31 bytes.
+                let bootorder_fwcfg_hash = measure_sha384(b"/rom@genroms/linuxboot_dma.bin\0");
 
                 // EV_EFI_VARIABLE_AUTHORITY: OVMF emits this once during BDS
                 // even when Secure Boot is disabled. The 32-byte event blob in