ci: detect USB boot entry by scanning existing UEFI entries

bootable-usb-prepare.sh does not create a new UEFI boot entry, and the
firmware's auto-created USB entry uses the USB controller device path
(PciRoot/.../USB(...)) with no GPT PARTUUID. The old before/after diff
and PARTUUID-only matching both found nothing and the stage errored.

Replace with a scan of all existing entries, most specific first:
PARTUUID of the target device, then dynamic model/vendor token from
lsblk on TARGET_USB_DEVICE, then a generic "USB" description match.
Verified against real efibootmgr -v output (resolves to the USB entry).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: mparamas-zz

Jenkinsfile

@@ -654,36 +654,54 @@ fi
 echo "Unmounting any partitions on ${USB_DEVICE}..."
 sudo umount ${USB_DEVICE}* 2>/dev/null || true
 
-# Snapshot UEFI boot entries so we can identify the one the installer adds.
-BOOT_BEFORE=$(sudo efibootmgr | grep -oE '^Boot[0-9A-Fa-f]{4}' | sort -u || true)
-
 echo "Running bootable-usb-prepare.sh on ${USB_DEVICE}..."
 sudo ./bootable-usb-prepare.sh "$USB_DEVICE" usb-bootable-files.tar.gz config-file
 
 echo "Current UEFI boot entries:"
 sudo efibootmgr -v
+EFI_OUT=$(sudo efibootmgr -v)
+
+# Identify the USB boot entry to boot from. bootable-usb-prepare.sh does NOT create a
+# new UEFI entry; the USB is reached via the firmware's auto-created removable entry,
+# whose device path is the USB controller (PciRoot/.../USB(...)) with no GPT PARTUUID.
+# So we scan all existing entries and pick the USB one, most specific match first.
+USB_ENTRY=""
+
+# Strategy 1: match a partition PARTUUID of the target device (works if the installer
+# wrote an ESP the firmware indexed as HD(GPT,<partuuid>)).
+for uuid in $(lsblk -no PARTUUID "$USB_DEVICE" 2>/dev/null); do
+    [ -z "$uuid" ] && continue
+    m=$(echo "$EFI_OUT" | grep -iE "^Boot[0-9A-Fa-f]{4}.*${uuid}" | grep -oE '^Boot[0-9A-Fa-f]{4}' | head -1 | sed 's/^Boot//')
+    if [ -n "$m" ]; then USB_ENTRY="$m"; echo "Matched USB boot entry by PARTUUID ${uuid}."; break; fi
+done
 
-BOOT_AFTER=$(sudo efibootmgr | grep -oE '^Boot[0-9A-Fa-f]{4}' | sort -u || true)
-# Prefer a newly-created entry; fall back to matching the target device PARTUUID.
-NEW_ENTRY=$(comm -13 <(echo "$BOOT_BEFORE") <(echo "$BOOT_AFTER") | head -1 | sed 's/^Boot//')
-if [ -z "$NEW_ENTRY" ]; then
-    echo "No new boot entry detected; matching by device PARTUUID..."
-    for uuid in $(lsblk -no PARTUUID "$USB_DEVICE" 2>/dev/null); do
-        [ -z "$uuid" ] && continue
-        MATCH=$(sudo efibootmgr -v | grep -iE "Boot[0-9A-Fa-f]{4}.*${uuid}" | grep -oE '^Boot[0-9A-Fa-f]{4}' | head -1 | sed 's/^Boot//')
-        if [ -n "$MATCH" ]; then NEW_ENTRY="$MATCH"; break; fi
+# Strategy 2: match by the target device's model/vendor tokens (ties the entry to THIS
+# exact USB drive, avoiding a wrong pick if several USB entries exist).
+if [ -z "$USB_ENTRY" ]; then
+    MODELVEND="$(lsblk -dno MODEL "$USB_DEVICE" 2>/dev/null) $(lsblk -dno VENDOR "$USB_DEVICE" 2>/dev/null)"
+    for tok in $(echo "$MODELVEND" | tr '_/.-' '    '); do
+        [ ${#tok} -ge 4 ] || continue
+        m=$(echo "$EFI_OUT" | grep -E '^Boot[0-9A-Fa-f]{4}' | grep -iF "$tok" | grep -oE '^Boot[0-9A-Fa-f]{4}' | head -1 | sed 's/^Boot//')
+        if [ -n "$m" ]; then USB_ENTRY="$m"; echo "Matched USB boot entry by device token '${tok}'."; break; fi
     done
 fi
-if [ -z "$NEW_ENTRY" ]; then
-    echo "ERROR: could not determine the installer UEFI boot entry automatically."
+
+# Strategy 3: match the firmware's removable USB entry by "USB" in its description.
+if [ -z "$USB_ENTRY" ]; then
+    m=$(echo "$EFI_OUT" | grep -E '^Boot[0-9A-Fa-f]{4}' | grep -iE 'usb' | grep -oE '^Boot[0-9A-Fa-f]{4}' | head -1 | sed 's/^Boot//')
+    if [ -n "$m" ]; then USB_ENTRY="$m"; echo "Matched USB boot entry by 'USB' description."; fi
+fi
+
+if [ -z "$USB_ENTRY" ]; then
+    echo "ERROR: could not determine the USB installer UEFI boot entry automatically."
     echo "       Inspect 'efibootmgr -v' above and set BootNext manually."
     exit 1
 fi
-echo "Installer UEFI boot entry: Boot${NEW_ENTRY}"
+echo "USB installer UEFI boot entry: Boot${USB_ENTRY}"
 
-# One-time boot into the installer entry, then reboot (backgrounded so ssh returns first).
-sudo efibootmgr -n "$NEW_ENTRY"
-echo "BootNext set to ${NEW_ENTRY}. Rebooting the flashing host in 5s..."
+# One-time boot into the USB entry, then reboot (backgrounded so ssh returns first).
+sudo efibootmgr -n "$USB_ENTRY"
+echo "BootNext set to ${USB_ENTRY}. Rebooting the flashing host in 5s..."
 sudo bash -c 'nohup sh -c "sleep 5; reboot" >/dev/null 2>&1 &'
 echo "Reboot scheduled."
 REMOTE_SCRIPT