My repro led nowhere (successful boot) but I was engaged by HP support and while responding to their email, I accidentaly found the issue.
My BIOS configuration script had a command to temporarily disable BitLocker in case configuration is reapplied for an already deployed system.
manage-bde -protectors -disable c:
However this inexplicably caused FAT32 partition to become encrypted. If I booted to UEFI PXE SCCM WinPE during next boot, WinPE silently cleared encryption and system would boot to hard drive again, causing further confusion.
But when for a test, I booted a Linux LiveCD, it showed encryption. 
I guess it has been like this for a while but only in this case C: happened to be UEFI boot partition (usually it's system partition). In retrospect, my WinPE repro image didn't also have BitLocker components...
I removed BitLocker command and now it normally boots to local hard drive after configuration change. Case closed for HP and time to engage Microsoft support...