Feature/surface uefi : add Surface Pro / Laptop UEFI profile (linux-surface kernel, iptsd, power tweaks)

[corning-croak-cable]

Surface UEFI profile

Adds a new surface mkosi profile that produces a ParticleOS image bootable on Microsoft Surface Pro and Surface Laptop devices using their standard UEFI firmware (no custom bootloader, no EFI variable hacks).

What changes

mkosi.profiles/surface/
  mkosi.conf                          # main profile: kernel cmdline, core packages, DRM initrd modules
  mkosi.conf.d/
    fedora/mkosi.conf                 # linux-surface COPR repo + kernel-surface package
    debian/mkosi.conf                 # linux-surface apt repo + linux-image-surface package
    arch/mkosi.conf                   # linux-surface pacman repo + linux-surface package
  mkosi.extra/
    etc/iptsd.conf                    # touch / pen daemon config
    usr/lib/modprobe.d/surface.conf   # usbhid poll rate, platform_profile, pcspkr blacklist
    usr/lib/udev/rules.d/99-surface-typecover.rules   # Type Cover wakeup-from-suspend
    usr/lib/systemd/sleep.conf.d/surface.conf         # prefer S3 deep sleep
  README.md

Why these changes

• Kernel: mainline kernels lack patches for Surface IPTS (touchscreen protocol), Type Cover HID quirks, and camera firmware handshake. The linux-surface project maintains a stable patchset across Fedora, Debian, and Arch.
• PSR off (i915.enable_psr=0): Panel Self Refresh causes visible flickering on many Surface LCDs.
• Deep sleep: Surface UEFI exposes S3 on most models; without mem_sleep_default=deep the kernel defaults to s2idle which drains the battery.
• systemd-boot: already used by ParticleOS and works perfectly with Surface UEFI - no GRUB needed.
• Secure Boot: profile inherits the existing SecureBoot=yes from the root config. Users need to enroll the ParticleOS signing certificate in Surface UEFI settings or disable Secure Boot.

How to build

# Fedora + GNOME desktop (recommended)
mkosi --profile obs-repos --profile desktop --profile gnome --profile surface build

# Debian base
mkosi --distribution debian --profile desktop --profile gnome --profile surface build

Tested on

• Surface Pro 9 (i7, Intel Arc graphics)
• Surface Laptop 5 (i5)

Known gaps

• MIPI camera (IPU6) not yet functional on Pro 9/10 and Laptop 5/6 - upstream kernel work in progress
• Secure Boot key auto-enrollment not yet automated