Offline install that lands fully patched: resolve against the ISO's own base

- autoinstall: dead mirror + fallback offline-install, so the installed
  base is exactly the ISO's; late-commands run offline-apt-install.sh on
  CIDATA packages/ (local apt repo, one transaction, errors fail the
  install, log /var/log/offline-apt-install.log); first boot no longer
  runs dpkg -i; real archive sources written back at the end.
- download-packages.sh --iso: unpacks the ISO's default install source
  into a docker image (pxe-iso-base:<version>) and downloads there: all
  updates of the base, the explicit list (zip included) and the newest
  pool packages with their closure; writes Packages + explicit.list and
  checks the set offline in a fresh base container (--network none).
- offline-apt-install.sh: new; also used by that check (--simulate).
- build-usb.sh: ships Packages, explicit.list and the script; refuses a
  set without them.
- tests/vm: pxetest-client-nosb (Secure Boot off, e1000e, SATA), one
  client at a time.

tests/vm/destroy.sh

@@ -5,13 +5,13 @@
 # Usage: tests/vm/destroy.sh
 source "$(dirname "$0")/common.sh"
 
-for vm in "$CLIENT_VM" "$SERVER_VM"; do
+for vm in "$CLIENT_VM" "$CLIENT2_VM" "$SERVER_VM"; do
     dom_exists "$vm" || continue
     [ "$(dom_state "$vm")" = "shut off" ] || virsh destroy "$vm" >/dev/null
     virsh undefine "$vm" --nvram >/dev/null
     log "undefined $vm"
 done
-for v in "$SERVER_DISK_VOL" "$USB_VOL" "$CLIENT_DISK_VOL"; do
+for v in "$SERVER_DISK_VOL" "$USB_VOL" "$CLIENT_DISK_VOL" "$CLIENT2_DISK_VOL"; do
     vol_exists "$v" || continue
     virsh vol-delete --pool "$POOL" "$v" >/dev/null
     log "deleted volume $v"