feat: add samsung Galaxy Book6 EE (PVAP) hardware profile and fixes

[lnitoud1]

Summary

This PR adds hardware support for the Samsung Galaxy Book6 Enterprise Edition
(Model PVAP, NP744BJG-KA2FR) to the Sécurix hardware registry, along with
several bug fixes benefiting all deployments.

Hardware

Field	Value
Manufacturer	Samsung Electronics
Model	Galaxy Book6 Enterprise Edition
Reference	NP744BJG-KA2FR (Model PVAP)
CPU	Intel Core Ultra 5 325 (Panther Lake-H)
RAM	16 GB LPDDR5
Storage	NVMe 477 GB (Phison PS5027-E27T)
GPU	Intel Arc Xe3 — driver: xe
Audio	Intel SOF PTL — sof-audio-pci-intel-ptl
NPU	Intel NPU50xx — driver: intel_vpu
Wi-Fi	Intel AX211 160MHz — iwlwifi
Secure Boot	lanzaboote v1.0.0 + sbctl + Microsoft keys
FIDO2	YubiKey Security Key C NFC (pamu2fcfg)

Compatibility

• NixOS hardware compatibility: 10/11 components (93%)
• Only limitation: fingerprint reader (no Linux driver available)
• Kernel audit performed on kernel 7.1.0-rc6

Changes

New

• hardware/galaxybook6-pvap.nix — complete hardware profile for Galaxy Book6 EE PVAP

Modified

• hardware/default.nix — added ./galaxybook6-pvap.nix import
• modules/self.nix — added "galaxybook6-pvap" to hardwareSKU enum + inventoryID alias (compatibility with DINUM nixpkgs fork)

Bug fixes

• modules/vpn/default.nix — added missing securix.vpn.enable option
  (causes build failure on any deployment using the DINUM nixpkgs fork)
• modules/anssi/preboot.nix — implemented ANSSI rules R5 and R6
  (boot.loader.systemd-boot.editor = false)

Testing

All three official Sécurix test suites passed:

• tests.anssi-minimal
• tests.minimal
• tests.idempotent-autoinstall

ANSSI-BP-028 rules validated: R5, R6, R7, R8, R9, R11, R12, R13
R10 (network filtering): pending validation in live network environment

Notes

• modules/anssi/preboot.nix R5/R6: lib.mkDefault removed as lib is not
  in scope in preboot.nix — direct assignment used instead
• Wi-Fi stability: two AP disconnections observed during testing —
  iwlwifi power_save=0 added as mitigation
• preconfigured-wifi-stations option commented out in examples/basic
  (not yet defined in module set — in development on upstream branch)

[rlahfa-dinum]

Hi there, we do not have any such HW, before merging this profile HW, we would like to understand in which context you are doing this contribution and what are you trying to achieve. We can obviously discuss this over email.

Thank you!

[lnitoud1]

Hi Ryan,

Thank you for reaching out, happy to provide context.

I am a B2B Technical Account Manager at Samsung Electronics France , specialized in Galaxy Book enterprise devices.

I initiated this contribution for two reasons :

1. Samsung had no hardware profile in the repository while Lenovo, HP and Dell already do. I wanted to address that gap proactively.

2. Beyond the commercial aspect, this is a genuine contribution : the PR also fixes a missing option in modules/vpn/default.nix that affects
   any deployment using the DINUM nixpkgs fork, and implements two ANSSI rules (R5,R6) that were left as TODO stubs in preboot.nix.

Regarding hardware access, we can provide a Samsung Galaxy book 6 EE (NP744BJG-KA2FR) to the Securix team for testing and validation purposes.
If that would help move the review forward, just let me know the best way to arrange this.

[jdauphant-dinum]

@lnitoud1 👋 you will received a message from me for further exchange on your proposal.