Clonezilla back up / restore by machine number

Boot menu: "Clonezilla: back up this PC" and "restore this PC" ask for the
machine number and boot Clonezilla (64-bit with Debian shim, or 32-bit
i686 by cpuid) with ocs_repository=smb3://clonezilla:<pw>@server/clonezilla/,
ocs_prerun fetching clonezilla-scripts/pxe-cz.sh and ocs_live_run running
it. The script validates the machine number, saves
<machine>-<YYYY-MM-DD-HHMM> (server time), writes pxe-meta.txt, runs
ocs-chkimg, and restores only that machine's images with -k1 -r after a
typed YES. The old entry is "Clonezilla: manual".

Playbook: clonezilla Samba user for the [clonezilla] share only, password
from clonezilla_smb_password (validated, filled into the menu
placeholder), scripts installed to the web root.

Webapp: Clonezilla backups page lists image folders and zips grouped by
machine number with serial/model/version/check, serial mismatch flag,
delete, move to another machine, streamed tar download, disk space bar
and an explicit keep-last-N retention with preview. Tests and a VM test
plan added.

tests/vm/README.md

@@ -88,5 +88,61 @@ grow the client while both are off, and put them back afterwards:
     virsh -c qemu:///system setmem    pxetest-client 4096M --config
 
 Menu keys from the host: `virsh -c qemu:///system send-key <vm> KEY_DOWN`
-(separator lines are skipped: Down x1 = Blancco, x3 = Clonezilla,
-x4 = Reboot), then KEY_ENTER; startnet answers are KEY_<digit> + KEY_ENTER.
+(separator lines are skipped: Down x1 = Blancco, x2 = Blancco debug,
+x3 = Clonezilla: back up, x4 = Clonezilla: restore, x5 = Clonezilla manual,
+x6 = Clonezilla manual 32-bit, x7 = Reboot), then KEY_ENTER; startnet
+answers are KEY_<digit> + KEY_ENTER.
+
+## Clonezilla back up / restore by machine number (VM test plan)
+
+Covers GetPxeScript.aspx (:cz_backup, :cz_restore, :cz_auto64/32),
+playbook/clonezilla-scripts/pxe-cz.sh, the clonezilla Samba account and the
+webapp's Clonezilla backups page. Re-run the playbook first (or rebuild) so
+the server has the new menu, /var/www/html/clonezilla-scripts/pxe-cz.sh and
+the clonezilla user; `--with-boot-tools` is needed for Clonezilla itself
+(clonezilla/ and clonezilla-i686/).
+
+0. Server checks (ssh pxe@<corp address>):
+   - `grep -c 'smb3://clonezilla:' /var/www/html/Altiris/iPXE/GetPxeScript.aspx` = 2,
+     and no `__CLONEZILLA_SMB_PASSWORD__` left in it.
+   - `curl -s http://172.16.9.1/clonezilla-scripts/pxe-cz.sh | head -1` = `#!/bin/bash`.
+   - `pdbedit -L | grep ^clonezilla:`; `smbclient //172.16.9.1/clonezilla -U clonezilla%<pw> -c ls`
+     works, `smbclient //172.16.9.1/winpeapps -U clonezilla%<pw> -c ls` is
+     refused (NT_STATUS_ACCESS_DENIED): the account opens only its share.
+   - Blancco Releases page: add and remove a test entry still works.
+1. Back up as 6501, 64-bit Secure Boot client (pxetest-client, raise RAM to
+   3-4 GiB as for Blancco: the live system plus the squashfs need about
+   1.5 GiB). Put something on its 1G disk first (e.g. boot client2's WinPE
+   and `diskpart` a partition, or `qemu-img` a small NTFS/ext4 image).
+   Menu Down x3, Enter. At `Machine number:` press Enter on empty (asks
+   again), then type 6501. Expect: Clonezilla boots through the shim (no
+   Secure Boot error), no language/keyboard questions, no password on
+   screen, the share mounts, one disk so no disk question, image
+   6501-YYYY-MM-DD-HHMM (server time, Eastern) is saved, "Checking the saved
+   image", SUCCESS banner with serial and model, power off after 60 s.
+2. Same as 6501 from a 32-bit BIOS client: a legacy-BIOS VM (SeaBIOS) with
+   `-cpu` lacking long mode (e.g. `<cpu mode='custom'><model>pentium3</model></cpu>`
+   or qemu32) so `cpuid --ext 29` fails and :cz_auto32 boots
+   clonezilla-i686. Expect pxe-meta.txt bits=32, firmware=bios,
+   clonezilla=clonezilla-live-3.2.0-5-i686. Also type `65 01` once:
+   Clonezilla says the number is not valid and asks again.
+3. Webapp (Tools > Clonezilla backups): both images under 6501, newest
+   first, serial and model from the VM's DMI (QEMU: serial empty unless
+   `<sysinfo>` sets one; set `<entry name='serial'>VMSER1</entry>`), size,
+   disks/partitions, Clonezilla version, 64/32-bit, Check = Checked.
+   Download .tar of one image and `tar tvf` it.
+4. Restore to a second, LARGER blank disk: attach a blank 4G disk to the
+   client (`virsh attach-disk ... --config`, then boot). Menu Down x4,
+   machine 6501. Expect only 6501's images, newest first; pick one; the
+   disk list shows both disks with model and size; pick the 4G one; type
+   YES. Clonezilla runs restoredisk with -k1 -r: afterwards `sfdisk -l`
+   (Clonezilla shell, s at the end prompt) shows the partitions scaled to
+   4G and the filesystem grown. Picking the 1G source disk for a 4G image
+   (repeat with the disks swapped) must be refused as SMALLER.
+5. Mismatch flag: back up the second client (different `<sysinfo>` serial)
+   also as 6501. The page shows "Serial mismatch" on 6501 and marks the odd
+   serial; Move to another machine... (e.g. 6502) clears it, and restore of
+   6502 lists the moved image.
+6. Retention: Settings > Keep last 1, Apply retention... lists the older
+   6501 image only; Delete removes it, the newest stays.
+