Generic build for other GE sites: no WJ data, one shopfloor type, Windows USB builder

Everything West Jefferson specific moved out to a separate repo
(pxe-site-wj): NTLARS/UDC/heat-treat backups keyed by WJ machine numbers,
CMM and Wax/Trace bay lists, WJ OpenText profiles, site-config.json, the
WJ preinstall list, and the WJ shopfloor PC types (Collections,
NoCollections, Common, Keyence, CMM, Genspect, HeatTreat, Wax/Trace,
Display, PartMarker) with GE-Enforce, machine numbers and the desktop
layout. The part-marker bench tools moved to their own repo. Dead
scripts removed: build-proxmox-iso, deploy-bios, sync_hardware_models,
mirror-from-gold, pull-bios, startnet-template.cmd.

Shopfloor is one generic type, gea-shopfloor-standard, with today's
timing:
- PPKG at first logon (unattend Order 10, unchanged).
- Install-AppList.ps1 runs C:\PreInstall\preinstall.json during setup.
- A new SYSTEM task, GE Shopfloor Post-PPKG, runs postppkg.json once
  after the post-PPKG reboot. It also clears AutoLogonCount after the
  ShopFloor handover (the Users-level monitor can be denied that HKLM
  write) and removes the Intune Sync task when done.
- Both lists ship empty. A site adds entries and installers.
- WinPE choice 3 goes straight to the PPKG menu. Staging, fetch and heal
  carry only the generic payload. The webapp's shopfloor sub-menu editor
  is gone, and the imaging tiles name the new stages.
- The playbook deploys the empty lists only if missing. It now deploys
  the PowerShell 7 MSI the shopfloor unattend installs, which it never
  did before.

Blancco site settings move into the webapp (Updates > Blancco releases):
business location, licensing Wi-Fi SSID and password. They are rendered
into the served preferences.xml and applied to every staged release, and
are seeded from site-vars (site_name, blancco_wifi_ssid,
blancco_wifi_password) only while none exist. The repo XML carries no
site values; the plaintext Wi-Fi password is gone from it.

New site_name and site_timezone settings: report and evidence-pack site
name, server clock and webapp time zone. No more West Jefferson defaults
in webapp/config.py or the dashboard title. Sync-BPRT.ps1 gets the
server address filled in at download instead of WJ's GE address.

USB on Windows:
- scripts/Build-PxeUsb.ps1 runs the same checks as build-usb.sh. It
  writes one FAT32 CIDATA partition (ISO files plus patched grub.cfg plus
  payload) with diskpart and reads every file back by SHA-256.
- Tested with Windows PowerShell 5.1 in the win11 VM, and the layout
  installs and first-boots in the pxetest VM.
- scripts/stage-usb-share.sh stages the build folder on a share.
- site-content/ is optional for both builders.

KB docs/kb/How_To_Deploy_PXE_Server_New_Site.html: new-site deployment,
Windows only, with a site-vars.yml guide.

Checks: webapp tests pass (5 suites); the unattend lint and playbook
syntax checks pass; every .ps1 parses; there are no WJ hosts, IPs, names
or PC types in playbook/, webapp/, scripts/ or autoinstall/.

scripts/build-usb.sh

@@ -30,10 +30,9 @@
 #   --skip-bios         do not copy bios-staging/
 #   --skip-drivers      do not copy drivers-staging/
 #   --skip-boot-tools   do not copy boot-tools/
-#   --skip-site-content do not copy site-content/ (Office, Adobe, certs,
-#                       Engineering Layer...: scripts/capture-site-content.sh).
-#                       Without it a new server cannot build standard or
-#                       engineer until that content is copied over by hand.
+#   --skip-site-content do not copy site-content/ even if present (optional
+#                       content captured from a running server with
+#                       scripts/capture-site-content.sh).
 #   --site-vars FILE    put FILE on CIDATA as playbook/site-vars.yml
 #                       (per-site values; see playbook/site-vars.example.yml)
 #   --no-site-vars      build without site vars (defaults; the first boot
@@ -321,11 +320,12 @@ fi
 # never split: a file FAT32 cannot hold refuses the build instead.
 if [ -n "$SITE_CONTENT_DIR" ]; then
     if [ ! -d "$SITE_CONTENT_DIR" ]; then
-        echo "ERROR: no site-content/ in $PAYLOAD_ROOT. Run scripts/capture-site-content.sh --apply"
-        echo "       (or pass --skip-site-content: the new server then lacks Office, Adobe, certs"
-        echo "       and the Engineering Layer until they are copied by hand)."
-        exit 1
+        # Optional: a site with no other PXE server has none.
+        echo "No site-content/ in $PAYLOAD_ROOT (optional): building without it"
+        SITE_CONTENT_DIR=""
     fi
+fi
+if [ -n "$SITE_CONTENT_DIR" ]; then
     if [ ! -f "$SITE_CONTENT_DIR/SHA256SUMS" ]; then
         echo "ERROR: site-content/SHA256SUMS missing. Re-run scripts/capture-site-content.sh --apply"
         exit 1
@@ -683,8 +683,7 @@ echo "    Copied playbook/"
 if [ -n "$SITE_VARS" ]; then
     echo "    Copied $SITE_VARS as playbook/site-vars.yml"
 else
-    echo "    WARNING: --no-site-vars: the first-boot playbook stops until"
-    echo "             pxe_nic_mac / corp_nic_mac are set on the server."
+    echo "    --no-site-vars: defaults; the first boot picks the imaging NIC by its link"
 fi
 # The unattend linter the playbook runs before it replaces the answer files
 # ({{ usb_mount }}/../scripts/lint-unattend.py).
@@ -860,11 +859,12 @@ if [ "$IMAGE_MODE" -eq 1 ]; then
     echo "  or attach it to a VM as a USB disk (see tests/vm/README.md)."
 else
     echo "Next steps:"
-    echo "  1. Cable both NICs: the imaging NIC (pxe_nic_mac) to the isolated"
-    echo "     imaging switch, the corp NIC (corp_nic_mac) to the GE network"
+    echo "  1. Plug in ONLY the imaging switch (GE unplugged), unless site-vars"
+    echo "     pins both MACs"
     echo "  2. Insert USB into the target machine, boot from it (F12 / boot menu)"
-    echo "  3. Ubuntu auto-installs; on first boot the playbook pins the NICs by"
-    echo "     MAC (imaging = static 172.16.9.1, corp = DHCP) and sets up PXE"
+    echo "  3. Ubuntu auto-installs; on first boot the playbook picks and pins the"
+    echo "     imaging NIC (static 172.16.9.1) and sets up PXE. Then plug GE into"
+    echo "     any other port"
     echo "  4. Check /var/log/first-boot.log; a failure shows a banner at login"
     echo "     and on the console, and first boot retries at the next reboot"
 fi