linux – How to stop Windows on external hard drive from overwriting UEFI records?

It’s kind of tricky since you need both of:

Make the grub EFI executable on the ESP (of the external drive) “portable”, as in “auto-discoverable”
Avoid using the “Windows Boot Manager” entry (which with at least some UEFI firmware there would/could be only one such entry, resulting in it being overwritten by another instance/set of WBM, even when it’s on the/a ESP of another disk) and allow the UEFI firmware to auto-discover the EFI executable copy of Windows Boot Manager at EFI/Boot/bootx64.efi

Essentially the only way to achieve #2 is to “constantly” delete EFI/Microsoft/Boot/bootmgfw.efi, since there would be a copy of it at EFI/Boot/bootx64.efi
(Constantly here essentially means every time after a Cumulative Update is applied, so it’s like monthly.) Also, you probably need to do this for both the internal and external drive.

The thing is, to achieve #1, what you need would be to have the grub EFI executable resides at EFI/Boot/bootx64.efi (Either you move the file at EFI/arch/grubx64.efi, or run grub-install with --removable.)

And the only solution to achieve both is probably to have separate ESP for grub and Windows Boot Manager respectively. (And if your UEFI firmware looks at only the first ESP / FAT-formatted partition of each disk for EFI executables at EFI/Boot/bootx64.efi, use grub to chainload the one on the Windows Boot Manager ESP.)

P.S. If you also have grub in the internal drive (in a dedicated ESP) and use it to chainload WBM, you might or might not need to keep deleting EFI/Microsoft/Boot/bootmgfw.efi copies, depending if the WBM entry would get moved to the top of the boot priority whenever updated (if that’s the case, the deletion will keep it “invalid”).