Boot KVM guests via UEFI by default; per-image firmware setting

Run 5 on the real host bisected the guest hang: the Debian 13 image
hangs after GRUB under SeaBIOS with or without our seed and with either
CPU model, and boots under OVMF. The image's legacy boot chain is the
problem, not the provider.

images.<key>.firmware is "uefi" (default) or "bios". The domain XML
emits <os firmware="efi"> with secure boot off, so libvirt selects the
OVMF binary and manages the NVRAM file, which the existing nvram undefine
flag removes. Direct-URL images default to UEFI too. OVMF joins the
hypervisor prerequisites; sample, config table, known gaps, decision log
and the execution log record the finding.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs/architecture.md

@@ -454,6 +454,13 @@ they read as choices, not accidents. Chronological by build step.
   unknown statuses, `nostate` means libvirt could not determine the
   state at all; answering that with delete-and-recreate is too drastic,
   so the next poll decides.
+- **KVM guests boot UEFI by default, secure boot off.** Found on the
+  first real host: Debian 13's generic image hangs after GRUB under
+  SeaBIOS regardless of CPU model or seed, and boots under OVMF. Every
+  current distro cloud image supports UEFI, so it is the default and
+  `firmware: bios` is the per-image escape; libvirt's firmware
+  autoselection (`<os firmware="efi">`) keeps the OVMF path out of the
+  operator's config. Secure boot is off so unsigned images boot too.
 - **A KVM domain GC cannot read is skipped, a host it cannot reach fails
   the sweep.** GC never deletes what it does not see, so leaving one
   domain out is safe; one corrupt domain blocking GC for every other one