I managed to boot a secure boot stick by copying a iso image to a usb thumb-drive using suse studio.
using gparted I created two partitions on the large unallocated space.
Here is the partition structure http://www.imagebam.com/image/4132e8261288206
It is persistent. That is what is added will be there on the next boot. And what programs are added will be there when you decide to install
After many failed attempts I discovered that kiwi persistent always put the read-write (cow?) at the small unallocated space at the beginning about 865 mb as /dev/sdc4 that gave the error
not enough space on cow
adding the sdc3 then sdc4 gave the directory structure sdc4 for kiwi to write to. sdc can be any sd that your thumb drive is
ps my signature is obsolete new computer how do I change it? or at least delete it
Good news I tested factory build 0524 live kde and it booted secure uefi this morning 11:18 gmt without changing anything and it booted to a graphical desktop