Offline install that lands fully patched: resolve against the ISO's own base

- autoinstall: dead mirror + fallback offline-install, so the installed
  base is exactly the ISO's; late-commands run offline-apt-install.sh on
  CIDATA packages/ (local apt repo, one transaction, errors fail the
  install, log /var/log/offline-apt-install.log); first boot no longer
  runs dpkg -i; real archive sources written back at the end.
- download-packages.sh --iso: unpacks the ISO's default install source
  into a docker image (pxe-iso-base:<version>) and downloads there: all
  updates of the base, the explicit list (zip included) and the newest
  pool packages with their closure; writes Packages + explicit.list and
  checks the set offline in a fresh base container (--network none).
- offline-apt-install.sh: new; also used by that check (--simulate).
- build-usb.sh: ships Packages, explicit.list and the script; refuses a
  set without them.
- tests/vm: pxetest-client-nosb (Secure Boot off, e1000e, SATA), one
  client at a time.

tests/vm/common.sh

@@ -47,6 +47,11 @@ CLIENT_MEM_MIB="${CLIENT_MEM_MIB:-2048}"
 SERVER_GE_MAC="52:54:00:9e:10:01"       # on 'default' NAT (GE/corp side)
 SERVER_IMAGING_MAC="52:54:00:9e:10:02"  # on pxetest-imaging (imaging side)
 CLIENT_MAC="52:54:00:9e:10:03"          # on pxetest-imaging only
+# Second client: Secure Boot OFF, e1000e NIC and SATA disk (in-box WinPE
+# drivers), so WinPE gets a network and startnet can map the shares.
+CLIENT2_VM="pxetest-client-nosb"
+CLIENT2_DISK_VOL="pxetest-client-nosb.qcow2"
+CLIENT2_MAC="52:54:00:9e:10:04"         # on pxetest-imaging only
 
 log() { printf '[pxetest] %s\n' "$*"; }
 die() { printf '[pxetest] ERROR: %s\n' "$*" >&2; exit 1; }