Auto-flush stale SMB/conntrack state on DHCP lease, one-source PPKG model

Three changes that go together so a re-image never hits "System error 53":

1. dnsmasq dhcp-script hook (playbook/pxe-server-helpers/pxe-dhcp-hook.sh)
   Fires on every add/del lease event. Runs conntrack -D and ss -K for the
   client IP so any stale ESTABLISHED SMB session from a previous boot is
   cleared before the client reconnects. Runs as root (dnsmasq default).
   Wired into /etc/dnsmasq.conf via dhcp-script= directive in the playbook.

2. One-source PPKG (playbook/startnet.cmd + startnet-template.cmd)
   The 5 per-Office PPKG copies were bit-for-bit identical; only the
   filename differs because BPRT parses Office and Region out of the name.
   Store one source file (e.g. GCCH_Prod_SFLD_v4.11.ppkg) and construct
   the BPRT-tagged target filename at menu-selection time from variables:
     SOURCE_PPKG / PPKG_VER / PPKG_EXP / REGION / OFFICE
   copy /Y "Y:\ppkgs\%SOURCE_PPKG%" "W:\Enrollment\%PPKG%"
   Bumped PPKG_VER v4.10 -> v4.11 and PPKG_EXP 20260430 -> 20270430.
   Saves ~30G on disk per version.

3. run-enrollment.ps1 already committed in 5a9c3db uses provtool.exe
   directly (no PowerShell cmdlet 180s timeout). Included here because it
   is part of the same end-to-end PPKG path.

playbook/pxe_server_setup.yml

@@ -125,6 +125,12 @@
       register: disk_expand
       changed_when: "'CHANGED' in disk_expand.stdout or 'resized' in disk_expand.stdout"
 
+    - name: "Deploy dnsmasq dhcp-script for per-lease state cleanup"
+      copy:
+        src: "{{ usb_mount }}/pxe-server-helpers/pxe-dhcp-hook.sh"
+        dest: /usr/local/sbin/pxe-dhcp-hook.sh
+        mode: '0755'
+
     - name: "Configure dnsmasq for DHCP and TFTP"
       copy:
         dest: /etc/dnsmasq.conf
@@ -140,6 +146,11 @@
           tftp-root={{ tftp_dir }}
           dhcp-boot=ipxe.efi
           log-dhcp
+          # Per-lease state cleanup: flush conntrack + port-445 sockets for
+          # the client IP on add/del. Prevents "System error 53" when a PXE
+          # client re-images the same machine and hits a stale SMB session.
+          # Script runs as root by default (dnsmasq --dhcp-scriptuser default).
+          dhcp-script=/usr/local/sbin/pxe-dhcp-hook.sh
 
     - name: "Create TFTP directory"
       file: