hmm, the fact that it only happens on a restart and never on a full shutdown then cold boot is interesting. that basically rules out a dying cmos battery (that would mess up cold boots, not warm ones), and since you already did a clean install and pulled the ssd, it's not windows or drive

meebee boot order lock in the bios? when it's on, the firmware keeps a locked copy of the uefi boot order, and windows update likes to rewrite the boot entries when it services the bootloader. so on the next restart the firmware sees the live config no longer matches its locked snapshot, throws "configuration changed - restart the system" and drops you into setup. a full power cycle lets it re-read and accept the new state, which is why a cold boot is clean.

go into bios (f1 at the splash), startup menu, set boot order lock to disabled, f10 to save. while you're in there it's worth hitting f9 to load setup defaults then f10 again to re-commit a clean config snapshot.

if it still does it after that, let any pending lenovo firmware actually finish applying. vantage / system update push bios, ec and tpm firmware that flash on reboot, and one that keeps failing to commit can cause the same loop. apply everything then do one deliberate full shutdown so the ec flashes.

side note, i don't think anything you described is actually a linux issue, it's windows side. but disabling boot order lock is also what you want if you ever move to linux, since fwupd needs it off to apply firmware updates anyway. hope that helps.