Auto-flush stale SMB/conntrack state on DHCP lease, one-source PPKG model

Three changes that go together so a re-image never hits "System error 53":

1. dnsmasq dhcp-script hook (playbook/pxe-server-helpers/pxe-dhcp-hook.sh)
   Fires on every add/del lease event. Runs conntrack -D and ss -K for the
   client IP so any stale ESTABLISHED SMB session from a previous boot is
   cleared before the client reconnects. Runs as root (dnsmasq default).
   Wired into /etc/dnsmasq.conf via dhcp-script= directive in the playbook.

2. One-source PPKG (playbook/startnet.cmd + startnet-template.cmd)
   The 5 per-Office PPKG copies were bit-for-bit identical; only the
   filename differs because BPRT parses Office and Region out of the name.
   Store one source file (e.g. GCCH_Prod_SFLD_v4.11.ppkg) and construct
   the BPRT-tagged target filename at menu-selection time from variables:
     SOURCE_PPKG / PPKG_VER / PPKG_EXP / REGION / OFFICE
   copy /Y "Y:\ppkgs\%SOURCE_PPKG%" "W:\Enrollment\%PPKG%"
   Bumped PPKG_VER v4.10 -> v4.11 and PPKG_EXP 20260430 -> 20270430.
   Saves ~30G on disk per version.

3. run-enrollment.ps1 already committed in 5a9c3db uses provtool.exe
   directly (no PowerShell cmdlet 180s timeout). Included here because it
   is part of the same end-to-end PPKG path.

playbook/pxe-server-helpers/pxe-dhcp-hook.sh

@@ -0,0 +1,38 @@
+#!/bin/bash
+#
+# pxe-dhcp-hook.sh - dnsmasq dhcp-script hook.
+#
+# Runs every time a PXE client gets/changes/releases a DHCP lease on
+# 10.9.100.0/24. Flushes conntrack entries and drops any lingering
+# TCP sockets for that client IP. Prevents stale server-side state from
+# causing "System error 53 - network path not found" when a WinPE client
+# re-images the same machine without a clean SMB session teardown.
+#
+# dnsmasq calls this with argv:
+#   $1 = action (add | old | del)
+#   $2 = mac address
+#   $3 = client IP
+#   $4 = hostname (may be empty)
+#
+# Must exit quickly; dnsmasq waits for it. Logs to syslog via logger.
+
+set +e
+
+action="$1"
+mac="$2"
+ip="$3"
+host="${4:-}"
+
+[ -z "$ip" ] && exit 0
+
+case "$action" in
+    add|del)
+        /usr/sbin/conntrack -D -s "$ip" >/dev/null 2>&1
+        /usr/sbin/conntrack -D -d "$ip" >/dev/null 2>&1
+        /usr/bin/ss -K "dst = $ip"  >/dev/null 2>&1
+        /usr/bin/ss -K "src = $ip"  >/dev/null 2>&1
+        logger -t pxe-dhcp-hook "cleared stale state for $action $ip ($mac${host:+ $host})"
+        ;;
+esac
+
+exit 0