Fix the unattend that broke Engineer builds; gate unattend deploys on the linter

a94c203 added a RunSynchronous Path of 417 chars to both std/eng answer
files. Windows caps it at 259 and then rejects the WHOLE answer file, so
an Engineer build stopped at 'Windows could not parse or process unattend
answer file'. The live files were restored to their pre-a94c203 versions
the same day.

- The status steps now fit: Send-ImagingStage.ps1 -Persist copies itself
  out of C:\Deploy (no cmd copy chain), short PowerShell switches, default
  arguments left out. Longest Path is 168 chars; lint-unattend passes.
  NOT deployed: these files must go live only through deploy-unattend.sh.
- scripts/deploy-unattend.sh: the only route for an answer file to a PXE
  server. Lints first and refuses on any error, backs up, swaps
  atomically, lints the live copy and restores the backup if that fails.
- .githooks/pre-commit (git config core.hooksPath .githooks): refuses a
  commit whose staged unattend fails the linter. Verified by planting a
  352-char Path (blocked) and against the exact a94c203 file (rejected).
- Boot menu: also accept SecureBoot read as hex 01, and show the raw values
  in the warning so a wrong read can be diagnosed from the screen.

scripts/deploy-unattend.sh

@@ -0,0 +1,60 @@
+#!/bin/bash
+#
+# deploy-unattend.sh - the ONLY way to put an unattend answer file on a PXE
+# server. A bad answer file does not fail at copy time: every bay imaged
+# with it stops at "Windows could not parse or process unattend answer
+# file" and has to be re-imaged. So this refuses to copy unless the
+# linter passes, backs the live file up, swaps it in atomically, and lints
+# the copy on the server afterwards.
+#
+# Usage: scripts/deploy-unattend.sh <image-type> <local FlatUnattendW10.xml>
+#   e.g. scripts/deploy-unattend.sh gea-engineer playbook/FlatUnattendW10-engineer.xml
+#
+# Env: PXE_SERVER (default 172.16.9.1), PXE_USER (default pxe); the
+# remote password is read from PXE_PASS or prompted for.
+
+set -euo pipefail
+
+IMAGE="${1:?usage: $0 <image-type> <local unattend xml>}"
+SRC="${2:?usage: $0 <image-type> <local unattend xml>}"
+SERVER="${PXE_SERVER:-172.16.9.1}"
+USER_="${PXE_USER:-pxe}"
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")"/.. && pwd)"
+LINT="$REPO_ROOT/scripts/lint-unattend.py"
+DEST="/srv/samba/winpeapps/$IMAGE/Deploy/FlatUnattendW10.xml"
+STAMP="$(date +%Y%m%d-%H%M%S)"
+
+case "$IMAGE" in
+    *[!A-Za-z0-9._-]*|"") echo "bad image type: $IMAGE" >&2; exit 2 ;;
+esac
+[ -f "$SRC" ] || { echo "no such file: $SRC" >&2; exit 2; }
+
+echo "== 1/3 lint $SRC"
+if ! python3 "$LINT" --local "$SRC"; then
+    echo "REFUSED: the linter failed; nothing was copied." >&2
+    exit 1
+fi
+
+if [ -z "${PXE_PASS:-}" ]; then
+    read -rs -p "password for $USER_@$SERVER: " PXE_PASS; echo
+fi
+export SSHPASS="$PXE_PASS"
+SSH=(sshpass -e ssh -o StrictHostKeyChecking=no -o ConnectTimeout=8 "$USER_@$SERVER")
+
+echo "== 2/3 back up and swap $DEST on $SERVER"
+sshpass -e scp -q -o StrictHostKeyChecking=no "$SRC" "$USER_@$SERVER:/tmp/unattend-$STAMP.xml"
+"${SSH[@]}" "set -e; P() { echo \"\$SSHPASS_REMOTE\" | sudo -S -p '' \"\$@\"; }; SSHPASS_REMOTE='$PXE_PASS'
+  [ -f '$DEST' ] || { echo 'no live file at $DEST' >&2; exit 1; }
+  P cp -a '$DEST' '$DEST.bak-$STAMP'
+  P install -m 644 -o root -g root /tmp/unattend-$STAMP.xml '$DEST.new'
+  P mv -f '$DEST.new' '$DEST'
+  rm -f /tmp/unattend-$STAMP.xml
+  echo \"backup: $DEST.bak-$STAMP\"; sha256sum '$DEST'"
+
+echo "== 3/3 lint the live copy"
+if ! python3 "$LINT" --server "$SERVER" --image "$IMAGE"; then
+    echo "LIVE FILE FAILS LINT: restoring the backup." >&2
+    "${SSH[@]}" "echo '$PXE_PASS' | sudo -S -p '' cp -a '$DEST.bak-$STAMP' '$DEST'"
+    exit 1
+fi
+echo "Deployed $SRC to $IMAGE."