WithDriversAndAppsProfile misses vendor event extended to PCR 2 after EV_SEPARATOR

Ubuntu 26.04.1, hardware-backed FDE.
**Fresh install asks for the recovery key on every boot.**
snap-bootstrap reports:
`invalid PCR policy data: the PCR policy is not authorized for the current configuration`
Auto-repair reports "success" but the next boot fails identically.

Hardware: Lenovo ThinkPad P14s Gen 6 AMD, 21QL0017US, BIOS R2XET39W (1.19)
2026-03-19, discrete Nuvoton TPM (tpm_tis NTC0702).
Secure Boot enabled, db contains MS UEFI CA 2011 and 2023; shim verified via the 2011 CA.

Root cause: the firmware measures a vendor event into PCR 2 after the EV_SEPARATOR events for PCRs 0-6:
```
event 36: PCR 2, type 0x00008401 (non-TCG), size 1, data 0x01,
sha256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
```
(it also measures EV_EFI_HANDOFF_TABLES into PCR 1 after the separator).

`efi/fw_load_handler.go measureDriversAndApps()` copies PCR 2 events only up to the separator, so the predicted PCR 2 is
`3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969`
while the live value (tpm2_pcrread) is
`6bdc358557e907a46d73add07d25754d7b319ec909c60490ae1514d73f8b2040`
PCR 0, 4 and 7 replay correctly. PCR 2 is included in the profile because the 2011 CA is distrusted for drivers, so there is no way to opt out.

The preinstall check passed (only PCR 1/3/5 unsupported warnings), so the installer offered TPM FDE on a system it cannot seal correctly. Either the profile should carry post-separator PCR 2 events, or the check should reject this log.

I can add binary or yaml tpm log if needed.

[tpm2_pcrread.log](https://github.com/user-attachments/files/32028915/tpm2_pcrread.log)
[tpm2_pcrread-02.log](https://github.com/user-attachments/files/32028916/tpm2_pcrread-02.log)

Start in efi/fw_load_handler.go at measureDriversAndApps(), then compare its PCR 2 replay with the attached tpm2_pcrread logs and the post-separator vendor event. Inspect the preinstall check as well; done means the profile accounts for the post-separator PCR 2 events or the check rejects logs that cannot be sealed correctly.

Written by the indexing model from the issue text.