fix(boot): tidy the devicetree, reboot and profile handling after review

Only warn about a devicetree under Secure Boot when the entry has one,
skip the fixup if its protocol can't be opened, and reject a devicetree
whose size is smaller than its header. Announce a reboot before the
delay, advertise the multi-profile UKI feature, and treat a Type 1 entry
with a profile after the first as an extra profile that is not picked as
the fallback default. A failure to read Sprout's own partition no longer
drops the entries of the XBOOTLDR partition, and the README lists every
initrd slot and describes the reboot behaviour more exactly.

crates/config/src/generators/bls.rs

@@ -29,7 +29,8 @@ pub struct BlsConfiguration {
     /// Whether to also read the Extended Boot Loader Partition, which is the partition with the
     /// XBOOTLDR type on the same disk as the partition Sprout was loaded from. Its entries are
     /// sorted with the others, and their paths are on that partition, so an action has to use
-    /// the `$entry-root` value to find them, such as `$entry-root\\$chainload`.
+    /// the `$entry-root` value to find them, such as `$entry-root\\$chainload`. Its unified kernel
+    /// images are always in `\\EFI\\Linux`.
     #[serde(default)]
     pub xbootldr: bool,
     /// Whether generated entries keep the name of the BLS entry file as-is.