NIC guard: ignore client EAPOL, re-check on carrier change, SMB-only lease cleanup

- pxe-nic-check: count 802.1X only from an authenticator (EAPOL type 0
  with EAP Request/Success/Failure). iPXE sends EAPOL-Start on every NIC
  open and Windows sends Start/Response, so a PXE-booting bay made the
  verdict 'ge' and the watch stopped dnsmasq for the floor.
- pxe-nic-check: join the STP/PAE/LLDP/CDP/PVST+ multicast groups on
  every capture socket, so CDP-only ports are heard on a plain NIC.
- pxe-nic-check --watch: if dnsmasq was (re)started inside the window,
  re-check (~6 s) before stopping it; skip when already stopped.
  New --state-cmd and --print-imaging.
- pxe-nic-carrier (+ pxe-nic-carrier.service): networkd-dispatcher hook
  for the imaging NIC only. Carrier loss stops dnsmasq; carrier gain
  restarts it through its guard if it was running or the hook stopped it.
- pxe-dhcp-hook.sh: clear only SMB (tcp 445/139) conntrack entries and
  sockets, not all traffic for the client, which raced iPXE's first
  HTTP fetch.
- GetPxeScript.aspx: every boot line has a failure branch (iPXE 2.0
  accepts an unsigned EFI kernel and fails at boot under Secure Boot,
  which aborted the script).
- Tests: client EAPOL, packet_mreq packing, watch race, shell helpers on
  stub PATH, lab scenarios eapol-client, br-eapol-client, race, carrier.

playbook/ipxe/GetPxeScript.aspx

@@ -37,13 +37,23 @@ initrd http://${server}/win11/EFI/Microsoft/Boot/BCD       EFI/Microsoft/Boot/BC
 initrd http://${server}/win11/EFI/Boot/bootx64.efi         EFI/Boot/bootx64.efi
 initrd http://${server}/win11/Boot/boot.sdi                Boot/boot.sdi
 initrd http://${server}/win11/sources/boot.wim             sources/boot.wim
-boot
+# A command that fails without || aborts the whole iPXE script (the PC
+# drops to firmware with no explanation), so every boot line has one.
+boot || goto winpe_failed
+
+:winpe_failed
+echo
+echo Windows PE boot FAILED (see the error above).
+echo Check that the PXE server is up and the win11 boot files are staged.
+prompt Press any key to return to menu... && goto menu || goto menu
 
 :clonezilla
 set base http://${server}/clonezilla
 kernel ${base}/vmlinuz boot=live username=user union=overlay config components noswap edd=on nomodeset nodmraid locales= keyboard-layouts= ocs_live_run="ocs-live-general" ocs_live_extra_param="" ocs_live_batch=no net.ifnames=0 nosplash noprompt fetch=${base}/filesystem.squashfs || goto secureboot_warn
-initrd ${base}/initrd.img
-boot
+initrd ${base}/initrd.img || goto boot_failed
+# iPXE 2.0 accepts an unsigned EFI kernel (PE fallback) and fails only
+# here under Secure Boot.
+boot || goto secureboot_warn
 
 :blancco
 iseq ${platform} pcbios && goto blancco_bios || goto blancco_efi
@@ -55,7 +65,7 @@ initrd --name intel-ucode.img http://${server}/blancco/intel-ucode.img || goto b
 initrd --name amd-ucode.img http://${server}/blancco/amd-ucode.img || goto blancco_bios_failed
 initrd --name config.img http://${server}/blancco/config.img || goto blancco_bios_failed
 initrd --name initramfs-bde-linux.img http://${server}/blancco/initramfs-bde-linux.img || goto blancco_bios_failed
-boot
+boot || goto blancco_bios_failed
 :blancco_bios_failed
 echo
 echo Blancco BIOS boot FAILED.
@@ -91,7 +101,14 @@ chain http://${server}/blancco/grubx64.efi || goto secureboot_warn
 
 :memtest
 kernel http://${server}/memtest/memtest.efi || goto secureboot_warn
-boot
+# iPXE 2.0 accepts an unsigned EFI image (PE fallback) and fails only
+# here under Secure Boot.
+boot || goto secureboot_warn
+
+:boot_failed
+echo
+echo Download FAILED (see the error above). Check the PXE server and retry.
+prompt Press any key to return to menu... && goto menu || goto menu
 
 :secureboot_warn
 echo