`EV_SEPARATOR` not recorded at end of boot

[crawfxrd]

• Model: any
• BIOS version: 2025-08-11_fe9c05c
• EC version: 2025-08-11_fe9c05c
• OS: Ubuntu 25.10
• Kernel:

Hardware-backed encryption cannot be used to install Ubuntu 25.10 which gives the error:

not encrypting device storage as checking TPM gave:
error with or detected from measurement log: reached
end of the log without seeing EV_SEPARATOR
events in all TCG defined PCRs

Steps to reproduce

1. Attempt to select FDE using hardware-backed encryption from "Advanced Features" during install

Expected behavior

• FDE can use TPM

Actual behavior

• Feature is not allowed to be used

Additional info

• May be cause of lemp12 cannot install Windows 11 with Secure Boot enabled #445 and TPM reports it's locked when trying to clear #498
• Should be done by edk2 Tcg2Dxe OnReadyToBoot event