Build/playbook re-run safety: corp access, netplan rollback, first-boot retry

H1  corp_admin_cidrs (UFW 22/9009 on the corp NIC from these only; refuses
    when it would lock out the current SSH client) and corp_ssh_password_auth
    (sshd drop-in, passwords only from the imaging subnet). Defaults keep the
    current behaviour and print a loud warning.
H2  pxe-netplan-apply.sh: pre-flight refusal (pxe-MAC NIC holds the default
    route, a DHCP lease or the route to an SSH client), run from the USB
    before anything changes; post-apply checks (names, imaging IPv4, corp
    IPv4 back within 30 s, SSH route) and a 120 s systemd-run auto-revert.
H3  restore() puts the previous NIC names back (two-phase rename via
    temporary names, so swaps work) before generate + apply.
H4  a failed rename is fatal (restore + exit 1); the play drops the old
    any-interface UFW rules only after verifying both NICs and their
    per-interface SSH rules.
H5  first-boot checks the playbook exit code, retries at next boot (max 5),
    writes /var/lib/pxe-firstboot.failed and /etc/issue + /etc/motd banners.
M1  build-usb.sh verifies iPXE files against the playbook pins, every wheel
    against its own package's hashes, drops the unpinned pip fallback,
    requires --site-vars or --no-site-vars.
M2  webapp restarts when the code, wheels or unit changed.
M3  ignore-carrier on the imaging NIC; ip_nonlocal_bind kept for the
    apache/networkd boot race.
M4  menu suffix must match blancco_kver; missing kernel with no earlier
    build is fatal; a live menu with the staged Blancco test entry is not
    overwritten.
M5  build-proxmox-iso.sh is unsupported (hard exit); use build-usb --image.
M6  deploy-unattend.sh: password via SSHPASS env and sudo stdin only,
    %q-quoted remote args, sha256 check of the live file; lint-unattend.py
    reads PXE_SERVER/PXE_USER/PXE_PASS and uses sshpass -e.
M7  the playbook lints the unattend files before the force: yes copies
    (lint-unattend.py ships on CIDATA as scripts/); pre-commit ACMR.
M8  Blancco initramfs build: no ignore_errors, pipefail, trap cleanup.
Also: Send-ImagingStage.ps1 deploy, carrier hook install tasks
(pxe-nic-carrier, networkd-dispatcher), L1 imaging-active hold
(allow_disruptive) and no iPXE downgrade below an Updates-page install,
L2 iso-volid, L3 kver pin read from the playbook, L4 cp -rL, L5 refuse
>= 4 GiB WinPE files, L6 PIP_DIR wipe guard, L7 per-package wheel hashes,
no online fallback, L8 check-updates.py (apt_pkg/cached compare, all
components, exit 2 on no debs / bad answers).

README.md

@@ -176,7 +176,7 @@ pxe-server/
 ├── bios-staging/                 # Dell BIOS update binaries (gitignored)
 ├── scripts/                      # Build, deploy, and helper scripts
 │   ├── build-usb.sh              # Builds the installer USB (2-partition)
-│   ├── build-proxmox-iso.sh      # Builds self-contained Proxmox installer ISO
+│   ├── build-proxmox-iso.sh      # UNSUPPORTED (use build-usb.sh --image)
 │   ├── prepare-boot-tools.sh     # Extracts and patches boot tool files
 │   ├── download-packages.sh      # Downloads offline .debs + pip wheels
 │   ├── download-drivers.py       # Downloads Dell drivers directly from dell.com
@@ -193,34 +193,13 @@ pxe-server/
 
 ## Proxmox Deployment
 
-A single ISO can be built for deploying the PXE server in a Proxmox VM:
-
-### Build the ISO
-
-```bash
-# Prerequisites (on build workstation)
-sudo apt install xorriso p7zip-full
-
-# Build the installer ISO
-./scripts/build-proxmox-iso.sh /path/to/ubuntu-24.04-live-server-amd64.iso
-```
-
-This creates `pxe-server-proxmox.iso` containing the Ubuntu installer, autoinstall config, all offline packages, the Ansible playbook, webapp, and boot tools.
-
-### Deploy on Proxmox
-
-1. Upload `pxe-server-proxmox.iso` to Proxmox storage (Datacenter -> Storage -> ISO Images)
-2. Create a new VM:
-   - **OS:** Linux 6.x kernel
-   - **BIOS:** OVMF (UEFI) or SeaBIOS
-   - **Memory:** 4096 MB
-   - **CPU:** 2+ cores
-   - **Disk:** 40+ GB (VirtIO SCSI)
-   - **Network:** Bridge connected to your isolated PXE network
-3. Attach the ISO as CD-ROM and start the VM
-4. Ubuntu auto-installs with zero interaction (~10-15 minutes)
-5. After reboot, first-boot configures all PXE services automatically
-6. Access the web interface at `http://172.16.9.1:9009`
+`scripts/build-proxmox-iso.sh` is no longer supported: it was a second,
+drifted copy of the installer. Build a disk image with
+`scripts/build-usb.sh --site-vars site-vars.yml --image pxe-usb.img auto UBUNTU.iso`
+and import it on the Proxmox host (`qm importdisk <vmid> pxe-usb.img
+<storage>`), attached after the system disk in the boot order. The VM needs
+two NICs: one on an isolated imaging bridge (no other DHCP server) and one
+on the corp bridge; their MACs go in `site-vars.yml`.
 
 ### Import WinPE Images