fixup! docs(netboot): add full netboot setup guide

Author: iav

extensions/netboot/README.md

@@ -62,8 +62,8 @@ file to copy into place.
 | `NETBOOT_NFS_PATH` | see below | Absolute NFS path of the rootfs on the server. The APPEND line uses exactly this string for `nfsroot=...`. |
 | `NETBOOT_HOSTNAME` | _(empty)_ | Per-host deployment. When set, the default `NETBOOT_NFS_PATH` becomes `/srv/netboot/rootfs/hosts/<hostname>` — each machine owns its own writable rootfs copy. When empty, the default is `/srv/netboot/rootfs/shared/${LINUXFAMILY}/${BOARD}/${BRANCH}-${RELEASE}` (one image, potentially reused by identical boards). |
 | `NETBOOT_CLIENT_MAC` | _(empty)_ | Client MAC (`aa:bb:cc:dd:ee:ff` or `aa-bb-cc-dd-ee-ff`). When set, the PXE config is written as `pxelinux.cfg/01-<mac>` (the PXELINUX per-MAC override) instead of `default.example`; multiple boards then coexist on one TFTP root, each picking its own extlinux. |
-| `ROOTFS_COMPRESSION` | `zstd` | Format of the rootfs archive produced by `create_image_from_sdcard_rootfs`. `zstd` → `.tar.zst`, `gzip` → `.tar.gz`, `none` → no archive at all. The `none` case requires `ROOTFS_EXPORT_DIR`. |
-| `ROOTFS_EXPORT_DIR` | _(empty)_ | Absolute path. When set, the rootfs tree is rsync'd directly into this directory in addition to (or instead of) the archive. Primary use: builder host is also the NFS server — single-step `build → boot` loop with no tar/unpack/rsync step. If this path is outside `${SRC}`, the extension bind-mounts it into the build container so the same path works on host and inside Docker. |
+| `ROOTFS_COMPRESSION` | `zstd` | Format of the rootfs archive produced by `create_image_from_sdcard_rootfs`. `zstd` (alias `zst`) → `.tar.zst`, `gzip` → `.tar.gz`, `none` → no archive at all. The `none` case requires `ROOTFS_EXPORT_DIR`. |
+| `ROOTFS_EXPORT_DIR` | _(empty)_ | Path suffix under the fixed base `${SRC}/output/netboot-export/`. When set, the rootfs tree is rsync'd directly into `${SRC}/output/netboot-export/${ROOTFS_EXPORT_DIR}` in addition to (or instead of) the archive. The path is always confined to that base — an absolute value like `/srv/nfs` is treated as a sub-directory (`${SRC}/output/netboot-export//srv/nfs`) so `rsync --delete` can never escape the netboot-export tree. If a NFS server on the build host expects `/srv/...`, symlink the base there once. Primary use: builder host is also the NFS server — single-step `build → boot` loop with no tar/unpack/rsync step. |
 
 ### Hook: `netboot_artifacts_ready`
 
@@ -77,7 +77,8 @@ the TFTP tree and rootfs archive/export are staged. Exposed context:
 | `NETBOOT_NFS_PATH` | As above. |
 | `NETBOOT_PXE_FILE` | `default.example` or `01-<mac>` — the file that was written under `pxelinux.cfg/`. |
 | `NETBOOT_ROOTFS_ARCHIVE` | Full path to the produced rootfs archive (empty when `ROOTFS_COMPRESSION=none`). |
-| `NETBOOT_HOSTNAME`, `NETBOOT_CLIENT_MAC` | The sanitized values the extension used. |
+| `NETBOOT_HOSTNAME` | Passed through verbatim — no sanitization. Hook code that embeds it in a shell command or a path must quote/escape itself. |
+| `NETBOOT_CLIENT_MAC` | The raw user value (`aa:bb:cc:dd:ee:ff` or `aa-bb-cc-dd-ee-ff`); also available as `NETBOOT_CLIENT_MAC_NORMALIZED` (lowercase, dashes) — the form used for the `pxelinux.cfg/01-<mac>` filename. |
 | `BOARD`, `LINUXFAMILY`, `BRANCH`, `RELEASE` | Standard build variables. |
 
 Implement this hook in `userpatches/extensions/` to rsync the TFTP