docs: Move Intel ME note to separate file

docs/intel-me.md

@@ -0,0 +1,16 @@
+# Intel Management Engine
+
+Intel-based machines by System76 come with the [Intel Management Engine][wiki]
+disabled. It is a proprietary, mostly undocumented, system that provides many
+extraneous features that are generally not usable or useful to our users, with
+multiple known vulnerabilities that compromise the entire system.
+
+The Intel ME is _required_ (since Nehalem, 2008), so cannot be removed. The
+[me\_cleaner] project is able to remove non-essential components, but currently
+does not support the ME version used on many of our systems. Instead, we [send
+a HECI command][heci_disable] to tell the Intel ME to disable runtime
+components during early boot.
+
+[wiki]: https://en.wikipedia.org/wiki/Intel_Management_Engine
+[me\_cleaner]: https://github.com/corna/me_cleaner
+[heci_disable]: https://github.com/system76/coreboot/blob/011439cb9196d6a71d394ead8c98dfd8ead325d4/src/soc/intel/cannonlake/me.c#L186