Fix MOK enrollment failure: hardcoded shebang and shell parameter passing

[Copilot]

Description

MOK enrollment tasks failed with ModuleNotFoundError: No module named 'fabric' when invoked via phoenixboot-wizard.sh or directly. Root causes:

1. pf_parser.py shebang: Hardcoded to #!/home/punk/.venv/bin/python (user-specific venv path)
2. Shell parameter passing: Tasks using bash -lc 'script.sh "$VAR"' expanded variables in subshell but scripts expected positional parameters $1, $2, $3

Changes

• pf_parser.py: Changed shebang to #!/usr/bin/env python3 for portability
• core.pf: Fixed parameter passing in os-mok-enroll, secure-mok-new
• secure.pf: Fixed parameter passing in secure-mok-verify, secure-enroll-mok, secure-mok-enroll-new, secure-unenroll-mok, secure-der-extract

Before:

shell bash -lc 'scripts/mok-management/enroll-mok.sh "${VAR1}" "${VAR2}" ${VAR3}'

After:

shell bash scripts/mok-management/enroll-mok.sh "${VAR1}" "${VAR2}" "${VAR3}"

• Breaking change?
• Impacts security?
• Includes tests?

How This Was Tested

Verified all MOK tasks execute and reach target scripts with correct parameters:

• ./pf.py os-mok-enroll - Reaches UEFI firmware check
• ./pf.py secure-mok-new - Generates keys successfully
• ./pf.py list - Shows all tasks correctly
• phoenixboot-wizard.sh - Advanced menu option 3 (Enroll MOK) executes
• CodeQL security scan: 0 alerts

Integration Instructions

N/A - Bug fix with no integration requirements.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Bug</issue_title>
<issue_description>Please fix the issue in this traceback $1</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Bug #146

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}