docs(extensions/netboot): document GNU tar requirement on the deploy target

The deploy hook untars the rootfs archive with --xattrs/--acls/--selinux,
which are GNU-tar extensions. Busybox tar (Alpine, OpenWRT) silently
drops xattrs on extract — file capabilities like security.capability on
ping/mtr are lost and they fail at runtime, regardless of the host
filesystem's xattr support. Capability-probe with fallback was
considered and rejected: there is no Busybox-tar code path that
preserves xattrs, so the only honest fallback would be silently broken
caps. Document the requirement instead.

Reported by coderabbitai (#9656 review, line 437).

Assisted-by: Claude:claude-opus-4.7

Author: iav

extensions/netboot/README.md

@@ -320,6 +320,15 @@ The minimal production setup is `tftpd-hpa` + `nfs-kernel-server` on
 one Linux host. **No DHCP runs on the server.** DHCP lives on the
 network router (see next section).
 
+> **GNU tar required on the deploy target.** When the deploy hook
+> ships a rootfs archive over SSH, it extracts with
+> `tar -xp --xattrs --xattrs-include='*' --acls --selinux`. Busybox tar
+> (Alpine, OpenWRT) silently drops xattrs on extract — `security.capability`
+> for binaries like `ping`/`mtr` is lost and they fail at runtime
+> regardless of host filesystem support. The `--acls`/`--selinux` flags
+> are also unrecognized on Busybox. Use a regular Linux distribution
+> with GNU tar on the NFS server.
+
 Directory layout:
 
 ```text