Offline install that lands fully patched: resolve against the ISO's own base

- autoinstall: dead mirror + fallback offline-install, so the installed
  base is exactly the ISO's; late-commands run offline-apt-install.sh on
  CIDATA packages/ (local apt repo, one transaction, errors fail the
  install, log /var/log/offline-apt-install.log); first boot no longer
  runs dpkg -i; real archive sources written back at the end.
- download-packages.sh --iso: unpacks the ISO's default install source
  into a docker image (pxe-iso-base:<version>) and downloads there: all
  updates of the base, the explicit list (zip included) and the newest
  pool packages with their closure; writes Packages + explicit.list and
  checks the set offline in a fresh base container (--network none).
- offline-apt-install.sh: new; also used by that check (--simulate).
- build-usb.sh: ships Packages, explicit.list and the script; refuses a
  set without them.
- tests/vm: pxetest-client-nosb (Secure Boot off, e1000e, SATA), one
  client at a time.

tests/vm/start.sh

@@ -1,16 +1,19 @@
 #!/bin/bash
 # Start pxetest VMs. Idempotent (a running VM is left alone).
-# Usage: tests/vm/start.sh [server|client|all]   (default: server)
-# Start the client only once the server's playbook has finished; both
-# together use 6 GiB.
+# Usage: tests/vm/start.sh [server|client|client2|all]   (default: server)
+#   client  = Secure Boot client (virtio NIC: reaches the iPXE menu and WinPE)
+#   client2 = Secure Boot OFF client, e1000e NIC (WinPE gets a network)
+# Start a client only once the server's playbook has finished, and only one
+# client at a time: server + one client = 6 GiB.
 source "$(dirname "$0")/common.sh"
 
 which="${1:-server}"
 case "$which" in
     server) vms=("$SERVER_VM") ;;
     client) vms=("$CLIENT_VM") ;;
+    client2|nosb) vms=("$CLIENT2_VM") ;;
     all) vms=("$SERVER_VM" "$CLIENT_VM") ;;
-    *) die "usage: $0 [server|client|all]" ;;
+    *) die "usage: $0 [server|client|client2|all]" ;;
 esac
 
 net_exists "$IMAGING_NET" || die "run create.sh first"
@@ -19,6 +22,15 @@ assert_imaging_isolated
 
 for vm in "${vms[@]}"; do
     dom_exists "$vm" || die "$vm not defined; run create.sh"
+    # RAM: one client at a time.
+    case "$vm" in
+        "$CLIENT_VM") other="$CLIENT2_VM" ;;
+        "$CLIENT2_VM") other="$CLIENT_VM" ;;
+        *) other="" ;;
+    esac
+    if [ -n "$other" ] && [ "$(dom_state "$other")" = "running" ]; then
+        die "$other is running; stop it first (tests/vm/stop.sh) to stay within RAM"
+    fi
     if [ "$vm" = "$SERVER_VM" ]; then
         vol_exists "$USB_VOL" || die "no $USB_VOL; run build-image.sh"
     fi