Image import keeps the shared BPRT link and seeds BPRT on a fresh box

An MCL import merged Deploy/Applications with rsync -a, which replaced each
image's BPRT symlink with a plain copy of the vendor folder. That copy has
no site overlay, so standard/engineer enrollment lost
Register-BulkEnrollTask-Standard.ps1 (specialize Order 39).

Now Deploy/Applications is imported first and without BPRT:
- where _shared/Applications/BPRT exists it is left alone (the BPRT page
  keeps it current) and the image link is put back;
- on a box with none yet, the imported BPRT seeds it: vendor
  Select-PCConfig.ps1 kept as -vendor, our overlay added, BOM fix applied;
- the import refuses before anything moves when that folder would not work
  (vendor scripts missing, or no overlay copy to add).

The two Register scripts join Select-PCConfig.ps1 in the repo. The playbook
already syncs shopfloor-setup to the enrollment share, so
config.BPRT_OVERLAY_DIR finds all three there; overlay_sources now falls
back to it for every overlay file, not only the shim.

webapp/services/deploy.py

@@ -22,7 +22,7 @@ def _replace_with_symlink(link_path, target_path):
     os.symlink(target_path, link_path)
 
 
-def sync_tree(src, dst, move=False, checksum=True):
+def sync_tree(src, dst, move=False, checksum=True, exclude=()):
     """Copy src -> dst with rsync, SKIPPING files whose content already
     matches and transferring only new or changed files.
 
@@ -32,8 +32,10 @@ def sync_tree(src, dst, move=False, checksum=True):
     set checksum=False for the faster size+mtime comparison. move=True
     removes source files after a successful transfer (frees the upload dir).
     Existing dst files not present in src are left untouched (merge, not
-    mirror - no --delete)."""
+    mirror - no --delete). exclude: rsync patterns left out ("/BPRT" is
+    the top-level BPRT only)."""
     flags = ["-a"]                        # recurse, preserve perms/times/symlinks
+    flags += [f"--exclude={pat}" for pat in exclude]
     if checksum:
         flags.append("--checksum")        # compare by content hash, not size+mtime
     if move:
@@ -75,10 +77,16 @@ def import_deploy(src_deploy, dst_deploy, target="", move=False):
     _transfer_tree = shutil.move if move else shutil.copytree
 
     os.makedirs(dst_deploy, exist_ok=True)
-    for item in os.listdir(src_deploy):
+    # Applications first: its BPRT check can refuse the import before
+    # anything else has moved.
+    for item in sorted(os.listdir(src_deploy), key=lambda n: n != "Applications"):
         src_item = os.path.join(src_deploy, item)
         dst_item = os.path.join(dst_deploy, item)
 
+        if item == "Applications" and os.path.isdir(src_item):
+            _import_applications(src_item, dst_item, move=move)
+            continue
+
         if not os.path.isdir(src_item):
             _transfer(src_item, dst_item)
             continue
@@ -103,6 +111,41 @@ def import_deploy(src_deploy, dst_deploy, target="", move=False):
             _transfer_tree(src_item, dst_item)
 
 
+def _import_applications(src_apps, dst_apps, move=False):
+    """Deploy/Applications, except BPRT. Every image links its BPRT to
+    _shared/Applications/BPRT, which the BPRT page keeps current and which
+    carries our overlay (services/bprt_sync.py). rsync -a replaces that link
+    with a plain copy of the vendor's folder, without the overlay, and
+    standard/engineer enrollment then fails at specialize Order 39. So the
+    imported BPRT only seeds the shared folder on a box that has none yet,
+    and is otherwise left out; the link is put back either way."""
+    from services import bprt_sync
+    bprt = next((n for n in os.listdir(src_apps)
+                 if n.lower() == "bprt" and os.path.isdir(os.path.join(src_apps, n))), None)
+    if bprt:
+        bprt_sync.seed_from_import(os.path.join(src_apps, bprt))
+    sync_tree(src_apps, dst_apps, move=move, exclude=[f"/{bprt}"] if bprt else ())
+    if bprt and move:
+        shutil.rmtree(os.path.join(src_apps, bprt), ignore_errors=True)
+        try:
+            os.rmdir(src_apps)
+        except OSError:
+            pass
+    shared = bprt_sync.bprt_dir()
+    if not os.path.isdir(shared) or os.path.islink(shared):
+        return
+    for n in os.listdir(dst_apps):
+        p = os.path.join(dst_apps, n)
+        if n.lower() == "bprt" and n != "BPRT":
+            if os.path.islink(p) or not os.path.isdir(p):
+                os.remove(p)
+            else:
+                shutil.rmtree(p)
+    link = os.path.join(dst_apps, "BPRT")
+    if not (os.path.islink(link) and os.path.realpath(link) == os.path.realpath(shared)):
+        _replace_with_symlink(link, shared)
+
+
 def allowed_import_source(source):
     """True if source is a USB mount or under the upload dir."""
     # Compare real paths: "<upload dir>/../.." passes a plain prefix test.