Offline install that lands fully patched: resolve against the ISO's own base

- autoinstall: dead mirror + fallback offline-install, so the installed
  base is exactly the ISO's; late-commands run offline-apt-install.sh on
  CIDATA packages/ (local apt repo, one transaction, errors fail the
  install, log /var/log/offline-apt-install.log); first boot no longer
  runs dpkg -i; real archive sources written back at the end.
- download-packages.sh --iso: unpacks the ISO's default install source
  into a docker image (pxe-iso-base:<version>) and downloads there: all
  updates of the base, the explicit list (zip included) and the newest
  pool packages with their closure; writes Packages + explicit.list and
  checks the set offline in a fresh base container (--network none).
- offline-apt-install.sh: new; also used by that check (--simulate).
- build-usb.sh: ships Packages, explicit.list and the script; refuses a
  set without them.
- tests/vm: pxetest-client-nosb (Secure Boot off, e1000e, SATA), one
  client at a time.

autoinstall/user-data

@@ -27,11 +27,19 @@ autoinstall:
         dhcp6: false
         optional: true
 
-  # The corp NIC may now have a lease, but the install stays offline-capable:
-  # no geoip lookup, and if the Ubuntu mirror is unreachable (Zscaler,
-  # no route) install from the ISO instead of failing.
+  # The install is always offline, even when the corp NIC has a lease and
+  # internet: the mirror points at a closed local port, so subiquity's
+  # mirror check fails and it installs from the ISO alone (no "security
+  # updates" step from the archive). The base is then exactly the ISO's,
+  # which is what download-packages.sh resolved the offline set against;
+  # late-commands patch it from CIDATA. The real archive sources are
+  # written back at the end of late-commands.
   apt:
     geoip: false
+    preserve_sources_list: false
+    primary:
+      - arches: [default]
+        uri: "http://127.0.0.1:9/ubuntu"
     fallback: offline-install
 
   # Storage configuration
@@ -56,23 +64,25 @@ autoinstall:
 
   # Installer-stage late commands
   late-commands:
-    # Step 1: Install deb packages from CIDATA USB
+    # Step 1: Upgrade and install from the offline set on CIDATA
+    # (packages/ is an apt repo: debs + Packages + explicit.list). Any apt
+    # error fails the install; the log is /var/log/offline-apt-install.log.
     - |
-      curtin in-target --target=/target -- bash -c '
+      curtin in-target --target=/target -- bash -euc '
       mkdir -p /mnt/cidata
       CIDATA_DEV=$(blkid -L CIDATA)
-      if [ -n "$CIDATA_DEV" ]; then
-        mount "$CIDATA_DEV" /mnt/cidata
-        if compgen -G "/mnt/cidata/packages/*.deb" > /dev/null; then
-          cp /mnt/cidata/packages/*.deb /tmp/
-          dpkg -i /tmp/*.deb 2>/dev/null || true
-          dpkg -i /tmp/*.deb 2>/dev/null || true
-          dpkg --configure -a 2>/dev/null || true
-          if command -v nmcli >/dev/null; then
-            systemctl enable NetworkManager
-          fi
-        fi
-        umount /mnt/cidata
+      mount -o ro "$CIDATA_DEV" /mnt/cidata
+      set +e
+      bash /mnt/cidata/offline-apt-install.sh /mnt/cidata/packages 2>&1 | tee /var/log/offline-apt-install.log
+      rc=${PIPESTATUS[0]}
+      set -e
+      umount /mnt/cidata
+      if [ "$rc" -ne 0 ]; then
+        echo "offline package install FAILED (rc=$rc), see /var/log/offline-apt-install.log" >&2
+        exit "$rc"
+      fi
+      if command -v nmcli >/dev/null; then
+        systemctl enable NetworkManager
       fi
       '
 
@@ -98,14 +108,10 @@ autoinstall:
       if [ -n "$CIDATA_DEV" ]; then
         mkdir -p /mnt/usb
         mount "$CIDATA_DEV" /mnt/usb
-        if compgen -G "/mnt/usb/packages/*.deb" > /dev/null; then
-          dpkg -i /mnt/usb/packages/*.deb 2>/dev/null || true
-          dpkg -i /mnt/usb/packages/*.deb 2>/dev/null || true
-          dpkg --configure -a 2>/dev/null || true
-        fi
         if [ -f /mnt/usb/playbook/pxe_server_setup.yml ]; then
           cd /mnt/usb/playbook
           ansible-playbook -i localhost, -c local pxe_server_setup.yml
+          cd /
         fi
         umount /mnt/usb
       fi
@@ -125,6 +131,25 @@ autoinstall:
       chmod +x /etc/rc.local
       '
 
+    # Step 5: Real archive sources for later online maintenance (the
+    # install used a dead mirror on purpose, see apt: above).
+    - |
+      rm -f /target/etc/apt/sources.list.d/*.list /target/etc/apt/sources.list.d/*.curtin.orig
+      echo "# Ubuntu sources have moved to /etc/apt/sources.list.d/ubuntu.sources" > /target/etc/apt/sources.list
+      cat > /target/etc/apt/sources.list.d/ubuntu.sources <<"EOF"
+      Types: deb
+      URIs: http://archive.ubuntu.com/ubuntu/
+      Suites: noble noble-updates noble-backports
+      Components: main restricted universe multiverse
+      Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
+
+      Types: deb
+      URIs: http://security.ubuntu.com/ubuntu/
+      Suites: noble-security
+      Components: main restricted universe multiverse
+      Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
+      EOF
+
   user-data:
     disable_root: false