As simple as it is, currently there is no "daedalus-security" yet as long as Daedalus still is in the testing stage.

Well, the encryption problem is fixed with the netinstall iso dated June 1st. The nopat issue still exists.

Thank you for your attention.

@Ralph: thank you. Can confirm that the 'nopat' option works. The installer boots into a VBox VM and you can select a language.

But: when trying to set up an encrypted LVM in expert mode, the installer stumbles, I get a red screen past entering the passphrase twice. On console 4 I see the message "partman-crypto: libgcc_s.so.1 must be installed for pthread_exit to work"

Well, I copy new fonts to:

TTF: /usr/share/fonts/truetype
OTF: /usr/share/fonts/opentype
ATM: /usr/share/fonts/type1, not really supported any more nowadays

and I create a new directory for them below that paths. Do the copy with root privileges, and make sure the directory has 755 as octal rights and the fonts have 644 as octal rights.

Works fine.

My two cents:
1.) The sudo issue
I am talking about the installer in expert mode. I am only using this mode since I am experienced enough to understand where the possible problems are, and I know what to expect and where I can tweak the installations.
The installer gives you the choice to enable the root account with an administrative password. Then sudo is not installed. When you think you need the sudo package, you have to add that package after first boot into the system.
If you deny a root password, sudo is getting installed, and you have to use it the Ubuntu way for admin tasks. When you do not like this, you can assign a password to root and then login as root or use su -.
2.) My experience with EFI
I have several modern PCs that partially have pure EFI bios like my laptop, some older ones (AMD X470/X570) still have CSM as backup. I am installing them in pure EFI mode, SB is disabled and the keys are getting deleted. I never had any trust in SB. CSM is off an all these machines. No other setting needs to be changed. My laptop was something special, an Acer Aspire5. To be able to modify the Bios settings, I had first of all to set an admin PW for the Bios.
Chimaera should be able to be installed with and without SB. You just have to boot the installer in EFI mode. Note: you will typically get the boot medium twice in the boot override: one is marked with the comment EFI, make sure you use this one. The other just shows the device name, thats for installation in legacy mode.
No idea about the HW in the Lifebook, and if some components are too new for stock Chimaera. If stock Chimaera does not satisfy, the first step would be to add kernel and firmware from backports.
3.) You are using the expert installer. Make sure you load the installer components. This is one of the first steps past selecting the language settings. If you skip that step you will get very limited install options, e.g. you ext2 as file system, no ext3/4 options.

Good luck.

Edith: just had a look at some test reports for this device. You should be fine with stock Chimaera.

Daedalus is testing, you will have to live with what you get. Its no different from Debian Testing = Bookworn. When it is released officially, you will get the full story.

I had some trouble with a 6700XT under Chimaera, refer to https://dev1galaxy.org/viewtopic.php?id=5364, moved to Daedalus and the PC is working fine since then.

Your system is encrypted, so the /usr/share/... path isn't available to grub when booting.

The solution is to copy the /usr/share/desktop-base/grub-themes/desktop-grub-theme-files to /boot/grub/themes. This will provide the default layout in an unencrypted location. Every now and then the /etc/default/grub may get overwritten by updates. Then you have to fiddle again.

I have no idea what will happen if you simply comment the themes-line from /etc/default/grub. That may cause a real hickup...

You need to dig a bit deeper into the path on your selected server. The Daedalus directory it self was created in 2021, below you should find up to date previews, the latest seems to be dated March 27th.

BTW: basic non-free stuff is already integrated, there are no separate isos as with Debian.

With a Ventoj multiboot stick never use automated install! You will need to use manual partitioning to have full control where the system goes. This works perfectly.

Could it be that grub searches for the theme on the encrypted system device? Check /etc/default/grub.

When this is the case you may need to move the theme files to the unencrypted /boot.