Offline install that lands fully patched: resolve against the ISO's own base

- autoinstall: dead mirror + fallback offline-install, so the installed
  base is exactly the ISO's; late-commands run offline-apt-install.sh on
  CIDATA packages/ (local apt repo, one transaction, errors fail the
  install, log /var/log/offline-apt-install.log); first boot no longer
  runs dpkg -i; real archive sources written back at the end.
- download-packages.sh --iso: unpacks the ISO's default install source
  into a docker image (pxe-iso-base:<version>) and downloads there: all
  updates of the base, the explicit list (zip included) and the newest
  pool packages with their closure; writes Packages + explicit.list and
  checks the set offline in a fresh base container (--network none).
- offline-apt-install.sh: new; also used by that check (--simulate).
- build-usb.sh: ships Packages, explicit.list and the script; refuses a
  set without them.
- tests/vm: pxetest-client-nosb (Secure Boot off, e1000e, SATA), one
  client at a time.

scripts/build-usb.sh

@@ -170,6 +170,17 @@ else
     fi
 fi
 
+# The installer patches and installs from packages/ as an apt repo
+# (autoinstall late-commands -> offline-apt-install.sh): it needs the index
+# and the explicit list that download-packages.sh writes with the debs.
+for f in "$OFFLINE_PKG_DIR/Packages" "$OFFLINE_PKG_DIR/explicit.list" "$REPO_ROOT/scripts/offline-apt-install.sh"; do
+    if [ ! -f "$f" ]; then
+        echo "ERROR: $f not found. Build the offline set with"
+        echo "       scripts/download-packages.sh --iso $ISO_PATH $OFFLINE_PKG_DIR"
+        exit 1
+    fi
+done
+
 if [ -n "$SITE_VARS" ] && [ ! -f "$SITE_VARS" ]; then
     echo "ERROR: --site-vars file not found: $SITE_VARS"
     exit 1
@@ -487,16 +498,17 @@ echo "[5/6] Copying autoinstall config, packages, and playbook to CIDATA..."
 # Copy cloud-init files
 t_cp "" "$AUTOINSTALL_DIR/user-data" "$AUTOINSTALL_DIR/meta-data"
 
-# Copy offline .deb packages into packages/ subdirectory
+# Copy the offline package set (an apt repo: debs + Packages + explicit.list)
+# into packages/, and the script the installer runs on it to the root.
 t_mkdir packages
+t_cp packages "$OFFLINE_PKG_DIR/Packages" "$OFFLINE_PKG_DIR/explicit.list"
 DEB_COUNT=0
-if [ -d "$OFFLINE_PKG_DIR" ] && compgen -G "$OFFLINE_PKG_DIR/*.deb" >/dev/null; then
+if compgen -G "$OFFLINE_PKG_DIR/*.deb" >/dev/null; then
     t_cp packages "$OFFLINE_PKG_DIR"/*.deb
     DEB_COUNT=$(find "$OFFLINE_PKG_DIR" -maxdepth 1 -name '*.deb' | wc -l)
-else
-    echo "    WARNING: no .deb packages in $OFFLINE_PKG_DIR (run download-packages.sh)"
 fi
-echo "    Copied $DEB_COUNT .deb packages to packages/"
+t_cp "" "$REPO_ROOT/scripts/offline-apt-install.sh"
+echo "    Copied $DEB_COUNT .deb packages + Packages + explicit.list to packages/"
 
 # Copy playbook directory
 t_cp "" "$PLAYBOOK_DIR"