Replace convoluted Source10 duplication and piecemeal delete_line approach with a single comprehensive replace rule matching kernel a8. Add almalinuxsecureboot0.cer, use pesign_name_0 almalinuxsecureboot0.