Capture site content from a live server so a new one can build every image

A freshly installed server could not build standard or engineer: about
8 GB they install from existed only on the running server.
scripts/capture-site-content.sh pulls it over SSH into the gitignored
payload:
- _shared/Applications/extra (Office, Adobe, OpenText, Java, fonts, Wi-Fi,
  Zscaler), without pxe-status/ (the playbook deploys that);
- each image's own Deploy/Applications files and folders (GE CA
  certificates, the Engineering Layer payload), without the repo-managed
  Install-EngineeringLayer.ps1 and without stale BPRT copies;
- the links images keep there, as links.txt;
- fresh bios-staging (*.exe plus models.txt, which the Dell update
  rewrites), boot.wim, and the known Blancco file set.

It dry-runs by default, compares by checksum (a Blancco config.img had the
same size and time as the stale copy), writes SHA256SUMS, and refuses what
FAT32 cannot hold: files of 4 GiB or more, Windows-illegal names, and
case-only name clashes.

build-usb.sh copies site-content/ unsplit and refuses to build without it
(unless --skip-site-content), or when SHA256SUMS is missing or does not
cover every file. The playbook checks SHA256SUMS, then merges the content
into winpeapps and recreates the links. It only links to folders that
exist, so it never creates an empty _shared BPRT, which would stop the
first MCL import from seeding it. Link lines are validated before anything
is copied.

pull-bios.sh is gone. It read a path the server no longer uses, with a
hard-coded password.

SETUP.md

@@ -86,6 +86,17 @@ to `pip-wheels/`. About 500 debs (~1.6 GB) + 8 wheels.
 
 Extracts boot files for Blancco and Clonezilla (64-bit with Debian's signed shim, so it boots with Secure Boot on, plus the last 32-bit release for XP-era PCs) into the `boot-tools/` directory. Automatically patches Blancco's `config.img` to auto-save erasure reports to the PXE server's Samba share.
 
+### Step 2b: Capture site content from a running server
+
+```bash
+./scripts/capture-site-content.sh            # dry run: lists what would change
+./scripts/capture-site-content.sh --apply    # pull it
+```
+
+Pulls what neither the repo nor the MCL image import brings, from a working PXE server (default 172.16.9.1, SSH key login as `pxe`): `_shared/Applications/extra` (Office, Adobe, OpenText, Java, fonts, Wi-Fi, Zscaler), the GE CA certificates and the Engineering Layer payload in each image's `Deploy/Applications`, and the links images keep there, into `site-content/`. It also refreshes `bios-staging/` (BIOS files and `models.txt`), `boot-files/boot.wim` and the Blancco files in `boot-tools/blancco/` from the server. It writes `site-content/SHA256SUMS`, which the playbook checks before restoring anything, and refuses content a FAT32 USB cannot hold. Without it a new server cannot build Standard or Engineer (`build-usb.sh` refuses unless you pass `--skip-site-content`).
+
+The first MCL image import on the new server then seeds `_shared/Applications/BPRT`, adding our overlay scripts from the repo.
+
 ### Step 3: Build the USB
 
 ```bash
@@ -234,7 +245,7 @@ pxe-server/
 │   ├── download-packages.sh      # Downloads all offline packages
 │   ├── download-drivers.py       # Downloads Dell drivers from dell.com
 │   ├── deploy-bios.sh            # Pushes BIOS updates to enrollment share
-│   ├── pull-bios.sh              # Pulls BIOS binaries from upstream cache
+│   ├── capture-site-content.sh   # Pulls site content + fresh payload from a live server
 │   ├── sync_hardware_models.py   # Syncs hardware model configs across images
 │   ├── Upload-Image.ps1          # Windows: upload MCL cache to PXE via SMB
 │   └── Download-Drivers.ps1      # Windows: download hardware drivers from GE CDN