Reorganize repo, enrollment share taxonomy, Blancco USB-build fixes, v4.10 PPKGs

Workstation reorganization:
- All build/deploy/helper scripts moved into scripts/ (paths updated to use
  REPO_ROOT instead of SCRIPT_DIR so they resolve sibling dirs from the new
  depth)
- New config/ directory placeholder for site-specific overrides
- Removed stale: mok-keys/, test-vm.sh, test-lab.sh, setup-guide-original.txt,
  unattend/ (duplicate of moved playbook/FlatUnattendW10.xml)
- README.md and SETUP.md structure listings updated, dead "Testing with KVM"
  section removed
- .claude/ gitignored

Enrollment share internal taxonomy (forward-looking; existing servers
unaffected since they keep their current boot.wim with flat paths):
- Single SMB share kept (WinPE only mounts one Y: drive), but content now
  organised into ppkgs/, scripts/, config/, shopfloor-setup/, pre-install/{bios,
  installers}, installers-post/cmm/, blancco/, logs/
- README.md deployed to share root explaining each subdir
- New playbook tasks deploy site-config.json + wait-for-internet.ps1 +
  migrate-to-wifi.ps1 explicitly (were ad-hoc on legacy servers)
- BIOS subdir moved into pre-install/bios/, preinstall/ renamed to pre-install/
- startnet.cmd + startnet-template.cmd updated with new Y:\subdir\ paths
- Bumped GCCH PPKG references v4.9 -> v4.10

Blancco USB-build fixes (so next fresh USB install boots Blancco end-to-end
without the manual fixup we did against GOLD):
- grub-blancco.cfg: kernel/initrd switched HTTP -> TFTP (GRUB's HTTP module
  times out on multi-MB files); added modprobe.blacklist=iwlwifi,iwlmvm,btusb
  (WiFi drivers hang udev on Intel business PCs)
- grubx64.efi rebuilt from updated cfg
- Playbook task added to create /srv/tftp/blancco/ symlinks pointing at the
  HTTP-served binaries

run-enrollment.ps1: OOBEComplete is now set AFTER PPKG install (Win11 22H2+
hangs indefinitely if OOBEComplete is set before the bulk-enrollment PPKG runs).

Also includes deploy-bios.sh / pull-bios.sh / busybox-static / models.txt
that were sitting untracked at the repo root.

playbook/pxe_server_setup.yml

@@ -300,32 +300,72 @@
         state: directory
         mode: '0777'
 
-    - name: "Create enrollment packages directory"
+    - name: "Create enrollment share with internal taxonomy"
       file:
-        path: /srv/samba/enrollment
+        path: "/srv/samba/enrollment/{{ item }}"
         state: directory
         mode: '0777'
+      loop:
+        - ""
+        - ppkgs
+        - scripts
+        - config
+        - shopfloor-setup
+        - pre-install
+        - pre-install/bios
+        - pre-install/installers
+        - installers-post
+        - installers-post/cmm
+        - blancco
+        - logs
 
-    - name: "Deploy PPKG enrollment packages to enrollment share"
+    - name: "Deploy enrollment share README"
+      copy:
+        dest: /srv/samba/enrollment/README.md
+        mode: '0644'
+        content: |
+          # Enrollment Share Layout
+          Single SMB share mounted by WinPE as Y: during imaging. Subdir layout:
+          - ppkgs/             GCCH bulk-enrollment PPKGs
+          - scripts/           run-enrollment.ps1, wait-for-internet.ps1, migrate-to-wifi.ps1
+          - config/            site-config.json, FlatUnattendW10*.xml, per-site overrides
+          - shopfloor-setup/   Per-PC-type post-imaging scripts
+          - pre-install/       WinPE-phase content (bios/, installers/, preinstall.json)
+          - installers-post/   Post-OOBE app installers (cmm/PCDMIS, etc.)
+          - blancco/           Blancco custom images / configs
+          - logs/              Client log uploads
+
+    - name: "Deploy PPKG enrollment packages to ppkgs/"
       shell: |
         set +e
         # Copy any whole PPKGs (small enough to fit on FAT32)
-        cp -f {{ usb_root }}/enrollment/*.ppkg /srv/samba/enrollment/ 2>/dev/null
+        cp -f {{ usb_root }}/enrollment/*.ppkg /srv/samba/enrollment/ppkgs/ 2>/dev/null
         # Reassemble any split files (foo.ppkg.part.00, .01, ... -> foo.ppkg)
         for first in {{ usb_root }}/enrollment/*.part.00; do
           [ -e "$first" ] || continue
           base="${first%.part.00}"
           name="$(basename "$base")"
           echo "Reassembling $name from chunks..."
-          cat "${base}.part."* > "/srv/samba/enrollment/$name"
+          cat "${base}.part."* > "/srv/samba/enrollment/ppkgs/$name"
         done
-        ls -lh /srv/samba/enrollment/*.ppkg 2>/dev/null
+        ls -lh /srv/samba/enrollment/ppkgs/*.ppkg 2>/dev/null
       ignore_errors: yes
 
-    - name: "Deploy run-enrollment.ps1 to enrollment share"
+    - name: "Deploy enrollment scripts to scripts/"
       copy:
-        src: "{{ usb_mount }}/shopfloor-setup/run-enrollment.ps1"
-        dest: /srv/samba/enrollment/run-enrollment.ps1
+        src: "{{ item.src }}"
+        dest: "/srv/samba/enrollment/scripts/{{ item.dest }}"
+        mode: '0644'
+      loop:
+        - { src: "{{ usb_mount }}/shopfloor-setup/run-enrollment.ps1", dest: "run-enrollment.ps1" }
+        - { src: "{{ usb_mount }}/wait-for-internet.ps1",              dest: "wait-for-internet.ps1" }
+        - { src: "{{ usb_mount }}/migrate-to-wifi.ps1",                dest: "migrate-to-wifi.ps1" }
+      ignore_errors: yes
+
+    - name: "Deploy site-config.json to config/"
+      copy:
+        src: "{{ usb_mount }}/shopfloor-setup/site-config.json"
+        dest: /srv/samba/enrollment/config/site-config.json
         mode: '0644'
       ignore_errors: yes
 
@@ -363,43 +403,28 @@
         directory_mode: '0755'
       ignore_errors: yes
 
-    - name: "Create preinstall bundle directory on enrollment share"
-      file:
-        path: "{{ item }}"
-        state: directory
-        mode: '0755'
-      loop:
-        - /srv/samba/enrollment/preinstall
-        - /srv/samba/enrollment/preinstall/installers
-
-    - name: "Deploy preinstall.json (installer binaries staged separately)"
+    - name: "Deploy preinstall.json to pre-install/"
       copy:
         src: "{{ usb_mount }}/preinstall/preinstall.json"
-        dest: /srv/samba/enrollment/preinstall/preinstall.json
+        dest: /srv/samba/enrollment/pre-install/preinstall.json
         mode: '0644'
       ignore_errors: yes
 
-    - name: "Create BIOS update directory on enrollment share"
-      file:
-        path: /srv/samba/enrollment/BIOS
-        state: directory
-        mode: '0755'
-
-    - name: "Deploy BIOS check script and manifest"
+    - name: "Deploy BIOS check script and manifest to pre-install/bios/"
       copy:
         src: "{{ usb_mount }}/shopfloor-setup/BIOS/{{ item }}"
-        dest: /srv/samba/enrollment/BIOS/{{ item }}
+        dest: "/srv/samba/enrollment/pre-install/bios/{{ item }}"
         mode: '0644'
       loop:
         - check-bios.cmd
         - models.txt
       ignore_errors: yes
 
-    - name: "Deploy BIOS update binaries from USB"
+    - name: "Deploy BIOS update binaries from USB to pre-install/bios/"
       shell: >
         if [ -d "{{ usb_root }}/bios" ]; then
-          cp -f {{ usb_root }}/bios/*.exe /srv/samba/enrollment/BIOS/ 2>/dev/null || true
-          count=$(find /srv/samba/enrollment/BIOS -name '*.exe' | wc -l)
+          cp -f {{ usb_root }}/bios/*.exe /srv/samba/enrollment/pre-install/bios/ 2>/dev/null || true
+          count=$(find /srv/samba/enrollment/pre-install/bios -name '*.exe' | wc -l)
           echo "Deployed $count BIOS binaries"
         else
           echo "No bios/ on USB - skipping"
@@ -668,6 +693,29 @@
         remote_src: yes
         mode: '0644'
 
+    - name: "Create TFTP blancco directory"
+      file:
+        path: "{{ tftp_dir }}/blancco"
+        state: directory
+        owner: nobody
+        group: nogroup
+        mode: '0755'
+
+    - name: "Create TFTP symlinks for Blancco kernel/initrd (GRUB HTTP times out on large files; TFTP is reliable)"
+      file:
+        src: "{{ web_root }}/blancco/{{ item }}"
+        dest: "{{ tftp_dir }}/blancco/{{ item }}"
+        state: link
+        force: yes
+        owner: nobody
+        group: nogroup
+      loop:
+        - vmlinuz-bde-linux
+        - initramfs-bde-linux.img
+        - intel-ucode.img
+        - amd-ucode.img
+        - config.img
+
     - name: "Build Ubuntu kernel modules tarball for Blancco"
       shell: |
         set -e