Engineering Layer: survive the C:\Deploy cleanup; the employee gets the icon

Engineer builds left the employee without "Configure my Engineering
Layer". First logon ran C:\Deploy\Applications\extra_engineering\
Install-EngineeringLayer.ps1, and the script itself lived in C:\Deploy:
std/eng have no autologon, so a PC that rebooted before the employee
signed in had lost C:\Deploy to the orchestrator's DeleteDeployDir task,
and nothing installed, silently.

- engineer unattend, specialize Order 37 (free slot): run the script with
  -StageOnly, copying the payload and the script to C:\PreInstall\engineering
  while C:\Deploy exists (Path 119 chars)
- first logon Order 11: run it from C:\PreInstall\engineering, falling back
  to C:\Deploy if staging did not happen
- the script (now in the repo, playbook/engineering/; it lived only on the
  server): after the install, restore the Public desktop icon if it is
  missing and the PC is not configured yet (no C:\TMP\DUU_Complete.log), and
  register Active Setup so each later user gets the icon on their own
  desktop when the Public one is gone. v3.1 puts the icon on the Public
  desktop; clicking it (configure, from GE's V: share) deletes it for all
- playbook deploys the script to gea-engineer extra_engineering; the 650 MB
  payload stays site content (documented in SITE-CUSTOMIZATION.md)

Tested in the win11 VM with the exact unattend strings and a stand-in
installer that skips the icon: specialize staged payload and script;
C:\Deploy deleted; first logon installed from the staged copy, restored the
icon and registered Active Setup. The per-user step as a new user: icon on
their desktop when the PC is unconfigured and the Public icon is gone; none
when configured or when the Public icon is there. Lint clean. Not deployed:
unattends go out only through scripts/deploy-unattend.sh.

playbook/pxe_server_setup.yml

@@ -1078,6 +1078,21 @@
         dest: "{{ samba_share }}/_shared/Applications/extra/pxe-status/Send-ImagingStage.ps1"
         mode: '0644'
 
+    # Engineering Layer wrapper (tracked in the repo; the 650 MB payload it
+    # installs - engineering_layer/ and prereqs/ - is site content beside it).
+    # The engineer unattend stages it in specialize and runs it at first logon.
+    - name: "Engineering Layer: create gea-engineer extra_engineering"
+      file:
+        path: "{{ samba_share }}/gea-engineer/Deploy/Applications/extra_engineering"
+        state: directory
+        mode: '0755'
+
+    - name: "Engineering Layer: deploy Install-EngineeringLayer.ps1"
+      copy:
+        src: "{{ usb_mount }}/engineering/Install-EngineeringLayer.ps1"
+        dest: "{{ samba_share }}/gea-engineer/Deploy/Applications/extra_engineering/Install-EngineeringLayer.ps1"
+        mode: '0644'
+
     - name: "Deploy BIOS check script + manifest to winpeapps/_shared/BIOS/"
       # Path matches what startnet.cmd reads at WinPE boot:
       #   net use B: \\172.16.9.1\winpeapps\_shared