For anyone else struggling with this, I finally figured it out. FYI this is not a fog issue, it’s a Windows secureboot UEFI issue.
Once I image a machine, I need to make sure secure boot is disabled, boot windows, and run these commands from an elevated command prompt:
mountvol s: /s
del s:*.* /f /s /q
bcdboot %systemroot% /s S:
That will rebuild the EFI partition files.
I did this, rebooted to the bios, re-enabled secureboot, and Windows successfully booted. Hooray.
My only issue now is that I can’t do unattended reimaging with secureboot enabled. If I push my golden image back to this system with secureboot enabled, Windows will fail to boot again until I make it rebuild the EFI partition files. What’s so weird to me is that I don’t have this problem on Wyse 5070 thin clients - I can leave secureboot enabled all day, reimage a system, and Windows boots just fine. But these Dell Optiplex 3000s sure don’t like it.