Ubuntu 26.04 installation failed in hardware-backed FDE mode on ThinkPad T14s Gen 5 Intel

**Given:**
- ThinkPad T14s Gen 5 Intel (released 2024)
- Secure Boot enabled, factory reset (currently in user mode) and enabled, Microsoft 3rd Party CA enabled, mode is 'User'
- Secure chip (TPM) enabled, cleared
- Firmware updated to the latest version.

**Reproduce:**
***First attempt:***
Start Ubuntu 26.04 installation from USB without any modification. Select Hardware-backed full disk encryption mode.
Installation failed with the following error:
```
PCR_UNUSABLE
error with secureboot policy (PCR7) measurements: unexpected EV_EFI_BOOT_SERVICES_APPLICATION event for \PciRoot(0x0)\Pci(0x14,0x0)\USB(0x0,0x0)\HD(2,GPT,2fdf80be-e145-40c5-aa51-61a53ab5282e)\\EFI\BOOT\BOOTX64.EFI after already seeing a verification event during the OS-present environment. This event should be for the initial boot loader
```

***Second attempt:***
Since the PCR error probably addressed in the commit [3f8b98c](https://github.com/canonical/secboot/commit/3f8b98c2db70bca872e81e8c97d6784e990bd010) (PR [#536](https://github.com/canonical/secboot/pull/536)), I do updated deb packages with `sudo apt update && sudo apt upgrade -y`, then snaps with `sudo snap refresh`. Started Ubuntu 26.04 installation again with Hardware-backed full disk encryption mode.
Installation failed with the following error:
```
HOST_SECURITY
error with system security: encountered an error when checking Intel BootGuard configuration: no hardware root-of-trust properly configured: system is in manufacturing mode
```
This is strange because the state of secureboot is 'User' and I didnt reset it to manufacturing mode at all.

**Further information:**
```
huypn@huypn-ThinkPad-T14s-Gen-5:~$ fwupdmgr security
Host Security ID: HSI:3! (v2.1.1)

HSI-1
✔ BIOS firmware updates: Enabled
✔ MEI key manifest: Valid
✔ MEI manufacturing mode: Locked
✔ csme18 override: Locked
✔ csme18 v18.1.18.2724: Valid
✔ Platform debugging: Disabled
✔ SPI write: Disabled
✔ SPI lock: Enabled
✔ SPI BIOS region: Locked
✔ Supported CPU: Valid
✔ TPM empty PCRs: Valid
✔ TPM v2.0: Found
✔ UEFI bootservice variables: Locked
✔ UEFI platform key: Valid
✔ UEFI secure boot: Enabled

HSI-2
✔ BIOS rollback protection: Enabled
✔ Intel BootGuard ACM protected: Valid
✔ Intel BootGuard: Enabled
✔ Intel BootGuard OTP fuse: Valid
✔ Intel GDS mitigation: Enabled
✔ IOMMU: Enabled
✔ Platform debugging: Locked
✔ TPM PCR0 reconstruction: Valid

HSI-3
✔ CET Platform: Supported
✔ Pre-boot DMA protection: Enabled
✔ Suspend-to-idle: Enabled
✔ Suspend-to-ram: Disabled

HSI-4
✔ SMAP: Enabled
✘ Encrypted RAM: Not supported

Runtime Suffix -!
✔ CET OS Support: Supported
✔ fwupd plugins: Untainted
✔ Linux kernel lockdown: Enabled
✔ UEFI db: Valid
✘ Linux swap: Unencrypted
✘ Linux kernel: Tainted

This system has HSI runtime issues.
» https://fwupd.github.io/hsi.html#hsi-runtime-suffix

Host Security Events
2026-05-29 14:21:51: ✔ BIOS rollback protection changed: Disabled → Enabled
2026-05-19 15:09:01: ✔ Kernel lockdown enabled
2026-05-19 15:09:01: ✔ UEFI db changed: Not found → Valid
2026-05-19 15:09:01: ✔ Secure Boot enabled
2026-05-18 20:38:53: ✘ Kernel is tainted
```

Start by comparing the PCR_UNUSABLE and HOST_SECURITY failures on the ThinkPad T14s Gen 5 Intel, then review secboot commit 3f8b98c and PR #536. Use the reported apt, snap, and fwupdmgr security steps to reproduce both installation attempts; done means hardware-backed full disk encryption installs successfully without either error.

Written by the indexing model from the issue text.