Fix one-time boot for grouped images

[hcaldicott]

Summary

• bypass the interactive menu when a valid enabled one-time boot image is set
• retain the normal menu fallback when the requested image is missing or disabled
• add regression coverage for grouped next-boot images and the fallback path

Why

Grouped images are rendered as labels inside their group submenu, but the existing implementation selects the one-time image label as the default on the top-level menu. Since that label is not present at the top level, iPXE selects a different valid top-level entry instead of booting the requested image.

Jumping directly to the image's boot section makes one-time boot deterministic and avoids requiring menu interaction, which is especially important for unattended provisioning.

Fixes #113

Validation

• go test ./...
• validated with a grouped AlmaLinux kernel-boot image on a physical UEFI PXE client
• confirmed the patched menu immediately requested the configured image's kernel and initrd