Offline install that lands fully patched: resolve against the ISO's own base

- autoinstall: dead mirror + fallback offline-install, so the installed
  base is exactly the ISO's; late-commands run offline-apt-install.sh on
  CIDATA packages/ (local apt repo, one transaction, errors fail the
  install, log /var/log/offline-apt-install.log); first boot no longer
  runs dpkg -i; real archive sources written back at the end.
- download-packages.sh --iso: unpacks the ISO's default install source
  into a docker image (pxe-iso-base:<version>) and downloads there: all
  updates of the base, the explicit list (zip included) and the newest
  pool packages with their closure; writes Packages + explicit.list and
  checks the set offline in a fresh base container (--network none).
- offline-apt-install.sh: new; also used by that check (--simulate).
- build-usb.sh: ships Packages, explicit.list and the script; refuses a
  set without them.
- tests/vm: pxetest-client-nosb (Secure Boot off, e1000e, SATA), one
  client at a time.

tests/vm/status.sh

@@ -12,14 +12,14 @@ echo "network $IMAGING_NET: $n"
 if net_active "$IMAGING_NET"; then
     (assert_imaging_isolated && echo "  isolation: OK (no forward, no ip, no host IPv4, only vnet ports)")
 fi
-for v in "$SERVER_DISK_VOL" "$USB_VOL" "$CLIENT_DISK_VOL"; do
+for v in "$SERVER_DISK_VOL" "$USB_VOL" "$CLIENT_DISK_VOL" "$CLIENT2_DISK_VOL"; do
     if vol_exists "$v"; then
         echo "volume $v: $(virsh vol-info --pool "$POOL" "$v" | awk '/Capacity|Allocation/{printf "%s %s %s  ", $1, $2, $3}')"
     else
         echo "volume $v: absent"
     fi
 done
-for vm in "$SERVER_VM" "$CLIENT_VM"; do
+for vm in "$SERVER_VM" "$CLIENT_VM" "$CLIENT2_VM"; do
     if dom_exists "$vm"; then
         echo "domain $vm: $(dom_state "$vm")"
         virsh domiflist "$vm" | tail -n +3 | grep -v '^$' | sed 's/^/    /'