Stop installing Zscaler twice, and reconcile the unattends with the share

Zscaler: Install-Zscaler.ps1 ships in all three MCL packages with
Zscaler-windows-4.7.0.317-installer-x64.msi bundled. It is tenant-aware
(geaerospace.com for GCCH, geaerospaceglobal.com for RoW, gegovdev.us for QA)
and passes enableFips=1.

Our FirstLogonCommands entry installed 4.5.0.337, two minor versions older,
without enableFips, and with userDomain hardcoded to geaerospace.com - wrong
for a RoW bay, which startnet's tenant sub-menu can produce. Two msiexec runs
against the same product at one logon also risk 1618. Removed, same reasoning
as Office.

THE BIGGER FIND, while removing it: this repo template was badly out of date
with the share, and the playbook deploys it with force: yes.

Missing here but present live: specialize Orders 39-48 - the bulk-enrollment
orchestrator registration (Order 39, Register-BulkEnrollTask-Standard.ps1), the
Default User startup-delay and Start-menu tweaks, the two NoAutoUpdate keys,
the 'vanilla' Shift+F10 fallback alias, and the removable-media block that stops
the PPKG being auto-detected at OOBE. Also missing: FirstLogonCommands Orders
4-10 (wuauserv disable, Default User hive edits, removable-media unblock).

A playbook run would therefore have stripped enrollment from every gea-standard
and gea-engineer bay. Both templates are now reconciled against the live share.

Engineer gets its own template. The two files differ only by FirstLogonCommands
Order 11, which installs the Engineering Layer - so deploying one shared file to
both, as the playbook did, silently removed that entry from gea-engineer on
every run. Split into FlatUnattendW10.xml and FlatUnattendW10-engineer.xml with
an explicit per-type loop.

lint-unattend.py passes clean on all three live files and all three repo copies.

playbook/pxe_server_setup.yml

@@ -735,17 +735,28 @@
       loop: "{{ shopfloor_types }}"
       ignore_errors: yes
 
-    # gea-standard (Win11) + gea-engineer (Win10) + ge-standard/engineer all use
-    # the same unattend. force: yes because drift between this file and the
-    # shared copies is what caused the Win10/Win11 search-cleanup regression
-    # earlier this session (d49f516) — prefer repo as source of truth.
-    - name: "Deploy standard/engineer unattend.xml"
+    # gea-standard and gea-engineer each get their OWN unattend. They are not
+    # interchangeable: the engineer file carries FirstLogonCommands Order 11,
+    # which installs the Engineering Layer, and nothing else differs. Deploying
+    # one shared template to both - which this task used to do - silently
+    # stripped that entry from gea-engineer on every playbook run.
+    #
+    # force: yes because drift between these files and the share is what caused
+    # the Win10/Win11 search-cleanup regression (d49f516). That only works if
+    # the repo copies are genuinely current: on 2026-08-19 this template was
+    # found to be missing specialize Orders 39-48 - including Order 39, which
+    # registers the bulk-enrollment orchestrator - so a playbook run would have
+    # removed enrollment from every standard and engineer bay. Both files are
+    # now reconciled against the live share. Re-check before trusting force: yes.
+    - name: "Deploy standard/engineer unattend.xml (per-type template)"
       copy:
-        src: "{{ usb_mount }}/FlatUnattendW10.xml"
-        dest: "{{ samba_share }}/{{ item }}/Deploy/FlatUnattendW10.xml"
+        src: "{{ usb_mount }}/{{ item.src }}"
+        dest: "{{ samba_share }}/{{ item.dest }}/Deploy/FlatUnattendW10.xml"
         mode: '0644'
         force: yes
-      loop: "{{ standard_types }}"
+      loop:
+        - { src: 'FlatUnattendW10.xml',          dest: 'gea-standard' }
+        - { src: 'FlatUnattendW10-engineer.xml', dest: 'gea-engineer' }
       ignore_errors: yes
 
     - name: "Daily cron to create/refresh Media.tag for all images"