Reorganize repo, enrollment share taxonomy, Blancco USB-build fixes, v4.10 PPKGs

Workstation reorganization:
- All build/deploy/helper scripts moved into scripts/ (paths updated to use
  REPO_ROOT instead of SCRIPT_DIR so they resolve sibling dirs from the new
  depth)
- New config/ directory placeholder for site-specific overrides
- Removed stale: mok-keys/, test-vm.sh, test-lab.sh, setup-guide-original.txt,
  unattend/ (duplicate of moved playbook/FlatUnattendW10.xml)
- README.md and SETUP.md structure listings updated, dead "Testing with KVM"
  section removed
- .claude/ gitignored

Enrollment share internal taxonomy (forward-looking; existing servers
unaffected since they keep their current boot.wim with flat paths):
- Single SMB share kept (WinPE only mounts one Y: drive), but content now
  organised into ppkgs/, scripts/, config/, shopfloor-setup/, pre-install/{bios,
  installers}, installers-post/cmm/, blancco/, logs/
- README.md deployed to share root explaining each subdir
- New playbook tasks deploy site-config.json + wait-for-internet.ps1 +
  migrate-to-wifi.ps1 explicitly (were ad-hoc on legacy servers)
- BIOS subdir moved into pre-install/bios/, preinstall/ renamed to pre-install/
- startnet.cmd + startnet-template.cmd updated with new Y:\subdir\ paths
- Bumped GCCH PPKG references v4.9 -> v4.10

Blancco USB-build fixes (so next fresh USB install boots Blancco end-to-end
without the manual fixup we did against GOLD):
- grub-blancco.cfg: kernel/initrd switched HTTP -> TFTP (GRUB's HTTP module
  times out on multi-MB files); added modprobe.blacklist=iwlwifi,iwlmvm,btusb
  (WiFi drivers hang udev on Intel business PCs)
- grubx64.efi rebuilt from updated cfg
- Playbook task added to create /srv/tftp/blancco/ symlinks pointing at the
  HTTP-served binaries

run-enrollment.ps1: OOBEComplete is now set AFTER PPKG install (Win11 22H2+
hangs indefinitely if OOBEComplete is set before the bulk-enrollment PPKG runs).

Also includes deploy-bios.sh / pull-bios.sh / busybox-static / models.txt
that were sitting untracked at the repo root.

startnet-template.cmd

@@ -66,11 +66,11 @@ echo   5. Pro Plus Office (x64) with Access
 echo   6. Skip enrollment
 echo.
 set /p enroll=Enter your choice (1-6):
-if "%enroll%"=="1" set PPKG=GCCH_Prod_SFLD_NoOffice_US_Exp_20260430_v4.8.ppkg
-if "%enroll%"=="2" set PPKG=GCCH_Prod_SFLD_StdOffice-x86_US_Exp_20260430_v4.8.ppkg
-if "%enroll%"=="3" set PPKG=GCCH_Prod_SFLD_StdOffice-x64_US_Exp_20260430_v4.8.ppkg
-if "%enroll%"=="4" set PPKG=GCCH_Prod_SFLD_ProPlusOffice-x86_US_Exp_20260430_v4.8.ppkg
-if "%enroll%"=="5" set PPKG=GCCH_Prod_SFLD_ProPlusOffice-x64_US_Exp_20260430_v4.8.ppkg
+if "%enroll%"=="1" set PPKG=GCCH_Prod_SFLD_NoOffice_US_Exp_20260430_v4.10.ppkg
+if "%enroll%"=="2" set PPKG=GCCH_Prod_SFLD_StdOffice-x86_US_Exp_20260430_v4.10.ppkg
+if "%enroll%"=="3" set PPKG=GCCH_Prod_SFLD_StdOffice-x64_US_Exp_20260430_v4.10.ppkg
+if "%enroll%"=="4" set PPKG=GCCH_Prod_SFLD_ProPlusOffice-x86_US_Exp_20260430_v4.10.ppkg
+if "%enroll%"=="5" set PPKG=GCCH_Prod_SFLD_ProPlusOffice-x64_US_Exp_20260430_v4.10.ppkg
 if "%enroll%"=="6" set PPKG=
 if "%enroll%"=="" goto enroll_menu
 
@@ -158,7 +158,7 @@ if not "%PCTYPE%"=="" set NEED_ENROLL=1
 if "%NEED_ENROLL%"=="0" goto enroll_staged
 net use Y: \\10.9.100.1\enrollment /user:pxe-upload pxe /persistent:no
 if "%PPKG%"=="" goto enroll_staged
-if not exist "Y:\%PPKG%" (
+if not exist "Y:\ppkgs\%PPKG%" (
     echo WARNING: %PPKG% not found on server. Enrollment will be skipped.
     set PPKG=
 )
@@ -251,8 +251,8 @@ echo Found Windows at W:
 mkdir W:\Enrollment 2>NUL
 
 REM --- Copy site config (drives site-specific values in all setup scripts) ---
-if exist "Y:\site-config.json" (
-    copy /Y "Y:\site-config.json" "W:\Enrollment\site-config.json"
+if exist "Y:\config\site-config.json" (
+    copy /Y "Y:\config\site-config.json" "W:\Enrollment\site-config.json"
     echo Copied site-config.json.
 ) else (
     echo WARNING: site-config.json not found on enrollment share.
@@ -260,14 +260,14 @@ if exist "Y:\site-config.json" (
 
 REM --- Copy PPKG if selected ---
 if "%PPKG%"=="" goto copy_pctype
-copy /Y "Y:\%PPKG%" "W:\Enrollment\%PPKG%"
+copy /Y "Y:\ppkgs\%PPKG%" "W:\Enrollment\%PPKG%"
 if errorlevel 1 (
     echo WARNING: Failed to copy enrollment package.
     goto copy_pctype
 )
-copy /Y "Y:\run-enrollment.ps1" "W:\Enrollment\run-enrollment.ps1"
-copy /Y "Y:\wait-for-internet.ps1" "W:\Enrollment\wait-for-internet.ps1"
-copy /Y "Y:\migrate-to-wifi.ps1" "W:\Enrollment\migrate-to-wifi.ps1"
+copy /Y "Y:\scripts\run-enrollment.ps1" "W:\Enrollment\run-enrollment.ps1"
+copy /Y "Y:\scripts\wait-for-internet.ps1" "W:\Enrollment\wait-for-internet.ps1"
+copy /Y "Y:\scripts\migrate-to-wifi.ps1" "W:\Enrollment\migrate-to-wifi.ps1"
 
 REM --- Create enroll.cmd at drive root as manual fallback ---
 > W:\enroll.cmd (
@@ -307,15 +307,15 @@ if exist "Y:\shopfloor-setup\%PCTYPE%" (
 )
 
 REM --- Stage preinstall bundle (apps installed locally to save Azure bandwidth) ---
-if exist "Y:\preinstall\preinstall.json" (
+if exist "Y:\pre-install\preinstall.json" (
     mkdir W:\PreInstall 2>NUL
     mkdir W:\PreInstall\installers 2>NUL
-    copy /Y "Y:\preinstall\preinstall.json" "W:\PreInstall\preinstall.json"
-    if exist "Y:\preinstall\installers" (
-        xcopy /E /Y /I "Y:\preinstall\installers" "W:\PreInstall\installers\"
+    copy /Y "Y:\pre-install\preinstall.json" "W:\PreInstall\preinstall.json"
+    if exist "Y:\pre-install\installers" (
+        xcopy /E /Y /I "Y:\pre-install\installers" "W:\PreInstall\installers\"
         echo Staged preinstall bundle to W:\PreInstall.
     ) else (
-        echo WARNING: Y:\preinstall\installers not found - preinstall.json staged without installers.
+        echo WARNING: Y:\pre-install\installers not found - preinstall.json staged without installers.
     )
 ) else (
     echo No preinstall bundle on PXE server - skipping.
@@ -329,9 +329,9 @@ REM during shopfloor-setup (Azure DSC provisions those creds later), so this
 REM bootstrap exists to get the first-install through. Post-imaging, the logon-
 REM triggered CMM-Enforce.ps1 takes over from the share.
 if /i not "%PCTYPE%"=="CMM" goto skip_cmm_stage
-if exist "Y:\cmm-installers\cmm-manifest.json" (
+if exist "Y:\installers-post\cmm\cmm-manifest.json" (
     mkdir W:\CMM-Install 2>NUL
-    xcopy /E /Y /I "Y:\cmm-installers" "W:\CMM-Install\"
+    xcopy /E /Y /I "Y:\installers-post\cmm" "W:\CMM-Install\"
     echo Staged CMM bootstrap to W:\CMM-Install.
 ) else (
     echo WARNING: Y:\cmm-installers not found - CMM PC cannot install Hexagon apps at imaging time.