Offline install that lands fully patched: resolve against the ISO's own base

- autoinstall: dead mirror + fallback offline-install, so the installed
  base is exactly the ISO's; late-commands run offline-apt-install.sh on
  CIDATA packages/ (local apt repo, one transaction, errors fail the
  install, log /var/log/offline-apt-install.log); first boot no longer
  runs dpkg -i; real archive sources written back at the end.
- download-packages.sh --iso: unpacks the ISO's default install source
  into a docker image (pxe-iso-base:<version>) and downloads there: all
  updates of the base, the explicit list (zip included) and the newest
  pool packages with their closure; writes Packages + explicit.list and
  checks the set offline in a fresh base container (--network none).
- offline-apt-install.sh: new; also used by that check (--simulate).
- build-usb.sh: ships Packages, explicit.list and the script; refuses a
  set without them.
- tests/vm: pxetest-client-nosb (Secure Boot off, e1000e, SATA), one
  client at a time.

tests/vm/create.sh

@@ -43,6 +43,10 @@ if ! vol_exists "$SERVER_DISK_VOL"; then
     virsh vol-create-as "$POOL" "$SERVER_DISK_VOL" "$SERVER_DISK_SIZE" --format qcow2 >/dev/null
     log "created $SERVER_DISK_VOL ($SERVER_DISK_SIZE thin qcow2)"
 fi
+if ! vol_exists "$CLIENT2_DISK_VOL"; then
+    virsh vol-create-as "$POOL" "$CLIENT2_DISK_VOL" 64G --format qcow2 >/dev/null
+    log "created $CLIENT2_DISK_VOL (64G thin, blank)"
+fi
 if ! vol_exists "$CLIENT_DISK_VOL"; then
     virsh vol-create-as "$POOL" "$CLIENT_DISK_VOL" 1G --format qcow2 >/dev/null
     log "created $CLIENT_DISK_VOL (1G blank)"
@@ -157,8 +161,49 @@ XML
     log "defined $CLIENT_VM"
 fi
 
+# --- second client: Secure Boot off, e1000e + SATA (WinPE in-box drivers) ---
+if ! dom_exists "$CLIENT2_VM"; then
+    cat >"$TMP/client2.xml" <<XML
+<domain type='kvm'>
+  <name>$CLIENT2_VM</name>
+  <memory unit='MiB'>$CLIENT_MEM_MIB</memory>
+  <vcpu>2</vcpu>
+  <os firmware='efi'>
+    <type arch='x86_64' machine='q35'>hvm</type>
+    <firmware>
+      <feature enabled='no' name='secure-boot'/>
+    </firmware>
+  </os>
+  <features><acpi/><apic/></features>
+  <cpu mode='host-passthrough'/>
+  <clock offset='localtime'/>
+  <devices>
+    <interface type='network'>
+      <source network='$IMAGING_NET'/>
+      <mac address='$CLIENT2_MAC'/>
+      <model type='e1000e'/>
+      <boot order='1'/>
+    </interface>
+    <disk type='file' device='disk'>
+      <driver name='qemu' type='qcow2'/>
+      <source file='$POOL_DIR/$CLIENT2_DISK_VOL'/>
+      <target dev='sda' bus='sata'/>
+      <boot order='2'/>
+    </disk>
+    <serial type='pty'/>
+    <console type='pty'/>
+    <graphics type='vnc' listen='127.0.0.1' autoport='yes'/>
+    <video><model type='vga'/></video>
+    <memballoon model='virtio'/>
+  </devices>
+</domain>
+XML
+    virsh define "$TMP/client2.xml" >/dev/null
+    log "defined $CLIENT2_VM"
+fi
+
 # Never attach a pxetest VM anywhere but default NAT / pxetest-imaging.
-for vm in "$SERVER_VM" "$CLIENT_VM"; do
+for vm in "$SERVER_VM" "$CLIENT_VM" "$CLIENT2_VM"; do
     while read -r _ type src _ _; do
         case "$type:$src" in
             network:"$GE_NET") [ "$vm" = "$SERVER_VM" ] || die "$vm is on $GE_NET" ;;