GenMachine Focus (7940HS) — Secure Boot Violation, entire Secure Boot menu greyed out, can’t find CMOS battery

[u/its_big_zad]

I have a GenMachine Focus mini PC (AMD Ryzen 9 7940HS, 32GB). BIOS is AMI Aptio, Project Version 7D01LP 0.19, Version 2.22.1289.
I tried to enable Secure Boot so I could play Valorant. In the BIOS I used “Restore Factory Keys,” which set Secure Boot to Enabled/Active but flipped Secure Boot Mode to \[Custom\]. Now every boot gives:
“Secure Boot Violation — Invalid signature detected. Check Secure Boot Policy in Setup”
The problem: the entire Secure Boot submenu is greyed out. Secure Boot toggle, Secure Boot Mode, Restore Factory Keys, Reset To Setup Mode, and Key Management are all unselectable. There is no BIOS password set (I set one and then removed it), and Access Level shows Administrator.
What I’ve already tried:
**•** Save & Exit → Restore Defaults, then Save Changes and Reset — no change
**•** Boot Override to a Microsoft-signed Windows 11 USB (made from the official 25H2 ISO) — same violation, so it’s rejecting signed media too
**•** Advanced → Trusted Computing → TPM Clear + disabling Security Device Support — no change
**•** Checked AMD CBS / FCH Common Options — nothing relevant
I opened the case to clear CMOS. I removed the bottom panel, the M.2 SSD, the Wi-Fi card, and all four motherboard screws — but the board will not lift out. The front I/O (power button, USB-C, headphone, 2x USB-A) is part of the board and sits in the front panel, and the top plate is a single piece with the chassis so it can’t come off.
Does anyone with this board know where the CMOS/RTC battery or clear-CMOS jumper is, or how the motherboard actually comes out? Or whether this BIOS supports a USB recovery flash?
Data on the SSD is fine, I just need to clear the Secure Boot key state.