build-usb: --site-vars puts the per-site vars on CIDATA; harness pins the VM NIC MACs

tests/vm/build-image.sh writes site-vars.yml with pxe_nic_mac (isolated
network NIC) and corp_nic_mac (NAT NIC) and passes it to build-usb.sh.

scripts/build-usb.sh

@@ -30,6 +30,8 @@
 #   --skip-bios         do not copy bios-staging/
 #   --skip-drivers      do not copy drivers-staging/
 #   --skip-boot-tools   do not copy boot-tools/
+#   --site-vars FILE    put FILE on CIDATA as playbook/site-vars.yml (the
+#                       per-site NIC MACs; see playbook/site-vars.example.yml)
 #   --yes               do not ask for confirmation (device mode still asks
 #                       YES for a non-removable device)
 #
@@ -46,7 +48,7 @@ usage() {
     echo "Usage: sudo $0 [options] /dev/sdX /path/to/ubuntu-24.04.iso [/path/to/winpe-images]"
     echo "       $0 [options] --image out.img SIZE|auto /path/to/ubuntu-24.04.iso [/path/to/winpe-images]"
     echo ""
-    echo "  Options: --payload-root DIR, --skip-enrollment, --skip-bios,"
+    echo "  Options: --payload-root DIR, --site-vars FILE, --skip-enrollment, --skip-bios,"
     echo "           --skip-drivers, --skip-boot-tools, --yes"
     echo ""
     echo "  The optional last argument is the path to WinPE deployment content"
@@ -67,6 +69,7 @@ SKIP_BIOS=0
 SKIP_DRIVERS=0
 SKIP_BOOT_TOOLS=0
 ASSUME_YES=0
+SITE_VARS=""
 POSITIONAL=()
 while [ $# -gt 0 ]; do
     case "$1" in
@@ -76,6 +79,9 @@ while [ $# -gt 0 ]; do
         --payload-root)
             [ $# -ge 2 ] || { usage; exit 1; }
             PAYLOAD_ROOT="$(cd "$2" && pwd)"; shift 2 ;;
+        --site-vars)
+            [ $# -ge 2 ] || { usage; exit 1; }
+            SITE_VARS="$2"; shift 2 ;;
         --skip-enrollment) SKIP_ENROLLMENT=1; shift ;;
         --skip-bios) SKIP_BIOS=1; shift ;;
         --skip-drivers) SKIP_DRIVERS=1; shift ;;
@@ -164,6 +170,11 @@ else
     fi
 fi
 
+if [ -n "$SITE_VARS" ] && [ ! -f "$SITE_VARS" ]; then
+    echo "ERROR: --site-vars file not found: $SITE_VARS"
+    exit 1
+fi
+
 # Verify required source files exist
 for f in "$AUTOINSTALL_DIR/user-data" "$AUTOINSTALL_DIR/meta-data" "$PLAYBOOK_DIR/pxe_server_setup.yml"; do
     if [ ! -f "$f" ]; then
@@ -490,6 +501,16 @@ echo "    Copied $DEB_COUNT .deb packages to packages/"
 # Copy playbook directory
 t_cp "" "$PLAYBOOK_DIR"
 echo "    Copied playbook/"
+if [ -n "$SITE_VARS" ]; then
+    mkdir -p "$WORK/sv"
+    cp "$SITE_VARS" "$WORK/sv/site-vars.yml"
+    t_cp playbook "$WORK/sv/site-vars.yml"
+    rm -rf "$WORK/sv"
+    echo "    Copied $SITE_VARS as playbook/site-vars.yml"
+elif [ ! -f "$PLAYBOOK_DIR/site-vars.yml" ]; then
+    echo "    WARNING: no playbook/site-vars.yml (and no --site-vars): the playbook"
+    echo "             stops until pxe_nic_mac / corp_nic_mac are set on the server."
+fi
 
 # Copy the whole webapp tree (app.py imports config, services/, views/;
 # the Blancco evidence timer runs blancco_evidence_monthly.py), minus caches.