Renumber PXE LAN from 10.9.100.0/24 to 172.16.9.0/24

Single-site bay-stuck issue at WJ: GE Intune Report IP script filters
Get-NetIPAddress on StartsWith("10.") and posts everything matching
to the GE Tines webhook. Bays at WJ get the PXE LAN 10.9.100.x IP
captured and reported -> GE backend tags bays as on a non-corp 10.x
subnet -> dynamic group eligibility for SFLD policy never matches.
Other GE sites work because their PXE LANs aren't on 10.x at all.

Renumber PXE LAN to RFC1918 172.16.9.0/24 so the GE filter naturally
skips wired PXE addresses without any disable-NIC dance.

Server-side already in flight (netplan dual-bound, dnsmasq scope +
boot URL repointed, blancco preferences + grub.cfg + iPXE GetPxeScript
all sed'd to 172.16.9.1). This commit is the playbook / scripts /
docs side: 109 hits across 35 files sed'd in one shot.

After this lands + boot.wim is rebuilt + bays renumber off DHCP,
the 10.9.100.1 binding will be dropped from netplan as the final
cleanup step.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/ARCHITECTURE.md

@@ -16,8 +16,8 @@ systems.
 
 ## Network layout
 
-- PXE server static IP: `10.9.100.1/24` on an isolated subnet.
-- DHCP range served by dnsmasq: `10.9.100.10 - 10.9.100.100`, 12h leases.
+- PXE server static IP: `172.16.9.1/24` on an isolated subnet.
+- DHCP range served by dnsmasq: `172.16.9.10 - 172.16.9.100`, 12h leases.
 - Default gateway and DNS handed out via DHCP point at the PXE server itself.
 - The subnet has no route to the corporate LAN. Client traffic (Blancco BMC
   cloud, Intune enrollment) goes out via WiFi after Windows boots; PXE-time
@@ -166,7 +166,7 @@ USB installer (2 partitions: ISO + CIDATA)
 Ubuntu auto-install + first-boot Ansible playbook
     |
     v
-Configured PXE server (10.9.100.1) ----+
+Configured PXE server (172.16.9.1) ----+
                                        |
 Windows PCs running Upload-Image.ps1 --+--> Image content (SMB, webapp import)
                                        |