Offline install that lands fully patched: resolve against the ISO's own base

- autoinstall: dead mirror + fallback offline-install, so the installed
  base is exactly the ISO's; late-commands run offline-apt-install.sh on
  CIDATA packages/ (local apt repo, one transaction, errors fail the
  install, log /var/log/offline-apt-install.log); first boot no longer
  runs dpkg -i; real archive sources written back at the end.
- download-packages.sh --iso: unpacks the ISO's default install source
  into a docker image (pxe-iso-base:<version>) and downloads there: all
  updates of the base, the explicit list (zip included) and the newest
  pool packages with their closure; writes Packages + explicit.list and
  checks the set offline in a fresh base container (--network none).
- offline-apt-install.sh: new; also used by that check (--simulate).
- build-usb.sh: ships Packages, explicit.list and the script; refuses a
  set without them.
- tests/vm: pxetest-client-nosb (Secure Boot off, e1000e, SATA), one
  client at a time.

tests/vm/stop.sh

@@ -1,15 +1,16 @@
 #!/bin/bash
 # Shut pxetest VMs down (ACPI, then force after a timeout). Keeps them
 # defined. Idempotent.
-# Usage: tests/vm/stop.sh [server|client|all]   (default: all)
+# Usage: tests/vm/stop.sh [server|client|client2|all]   (default: all)
 source "$(dirname "$0")/common.sh"
 
 which="${1:-all}"
 case "$which" in
     server) vms=("$SERVER_VM") ;;
     client) vms=("$CLIENT_VM") ;;
-    all) vms=("$CLIENT_VM" "$SERVER_VM") ;;
-    *) die "usage: $0 [server|client|all]" ;;
+    client2|nosb) vms=("$CLIENT2_VM") ;;
+    all) vms=("$CLIENT_VM" "$CLIENT2_VM" "$SERVER_VM") ;;
+    *) die "usage: $0 [server|client|client2|all]" ;;
 esac
 for vm in "${vms[@]}"; do
     dom_exists "$vm" || continue