Fix Display sync loop, PPKG deployment, dnsmasq cron, dpkg configure

- Monitor-IntuneProgress: Display PCs skip DSC phases entirely (no SAS
  token, no DSCInstall.log), complete after Phase 1 identity. Renderer
  hides Phase 2-5 for Display type.
- Playbook: deploy PPKG files and run-enrollment.ps1 from USB to
  enrollment share. Bump dnsmasq restart cron from 15s to 30s.
- build-usb.sh: copy enrollment/ directory (PPKGs) onto USB if present.
- user-data: add dpkg --configure -a after offline .deb install to fix
  packages left in unconfigured state (cron, systemd-timesyncd).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

build-usb.sh

@@ -270,6 +270,18 @@ else
     echo "    No boot-tools/ found (run prepare-boot-tools.sh first)"
 fi
 
+# Copy enrollment directory (PPKGs, run-enrollment.ps1) if present
+ENROLLMENT_DIR="$SCRIPT_DIR/enrollment"
+if [ -d "$ENROLLMENT_DIR" ]; then
+    mkdir -p "$MOUNT_POINT/enrollment"
+    cp -r "$ENROLLMENT_DIR"/* "$MOUNT_POINT/enrollment/" 2>/dev/null || true
+    PPKG_COUNT=$(find "$MOUNT_POINT/enrollment" -name '*.ppkg' 2>/dev/null | wc -l)
+    ENROLL_SIZE=$(du -sh "$MOUNT_POINT/enrollment" | cut -f1)
+    echo "    Copied enrollment/ ($ENROLL_SIZE, $PPKG_COUNT PPKGs)"
+else
+    echo "    No enrollment/ directory found (PPKGs can be uploaded via webapp later)"
+fi
+
 # Optionally copy WinPE deployment images
 if [ -n "$WINPE_SOURCE" ] && [ -d "$WINPE_SOURCE" ]; then
     echo "    Copying WinPE deployment content from $WINPE_SOURCE..."