Playbook: tools and Zscaler root CA the webapp Updates pages need

sbsigntool, zip and curl, the Zscaler root CA in the system store (GitHub is
TLS-intercepted on the corporate NIC; downloads.dell.com is not), and
/var/lib/pxe-webapp/updates.

playbook/pxe_server_setup.yml

@@ -18,6 +18,10 @@
         - ansible
         - wimtools
         - conntrack
+        - sbsigntool    # sbverify: iPXE update signature checks
+        - p7zip-full    # 7z: Dell driver packs, catalog cabs, Blancco ISO
+        - zip           # driver zips PESetup unpacks
+        - curl          # Updates page downloads
       register: pkg_check
       failed_when: false
       changed_when: false
@@ -34,6 +38,12 @@
     samba_share: "/srv/samba/winpeapps"
     usb_mount: "/mnt/usb/playbook"     # playbook location on USB
     usb_root: "/mnt/usb"               # CIDATA partition root
+    # Zscaler Root CA: GE's Zscaler re-signs GitHub TLS, so the iPXE update
+    # check fails without it. Repo copy first, else the copy on the image share.
+    zscaler_ca_src: "{{ playbook_dir }}/certs/zscaler-root-ca.crt"
+    # _media/<pctype> links the base image's entries, so also look in the
+    # image roots (on a rebuild the _media views may not exist yet).
+    zscaler_ca_share_glob: "{{ samba_share }}/_media/*/Deploy/Applications/ZscalerCommercialCertificate-2048-SHA256.crt {{ samba_share }}/gea-*/Deploy/Applications/ZscalerCommercialCertificate-2048-SHA256.crt"
     image_types:
       - gea-standard
       - gea-engineer
@@ -41,8 +51,9 @@
     shopfloor_types:
       - gea-shopfloor
     # Image variants that share the generic Win10/Win11 unattend
-    # (gea-standard is now Win11, gea-engineer is Win10 — same unattend file
-    # drives both because the RunSynchronous entries are OS-version-agnostic).
+    # (gea-standard and gea-engineer both deploy Win11 Pro 24H2 now; the same
+    # unattend file drives both because the RunSynchronous entries are
+    # OS-version-agnostic).
     standard_types:
       - gea-standard
       - gea-engineer
@@ -1067,6 +1078,59 @@
         content: |
           @reboot root /bin/sleep 15 && /usr/bin/systemctl restart dnsmasq.service
 
+    # --- Updates pages (Dell drivers/BIOS, iPXE, Blancco) ---
+    # The webapp downloads from downloads.dell.com and GitHub through the
+    # corporate NIC and unpacks with 7z/zip; sbverify checks iPXE signatures.
+    - name: "Install tools the webapp Updates pages need (if missing)"
+      apt:
+        name:
+          - sbsigntool
+          - p7zip-full
+          - zip
+          - unzip
+          - curl
+        state: present
+      ignore_errors: yes
+
+    - name: "Find the Zscaler Root CA (playbook copy, else the image share)"
+      shell: |
+        for f in "{{ zscaler_ca_src }}" {{ zscaler_ca_share_glob }}; do
+          if [ -f "$f" ] && grep -q "BEGIN CERTIFICATE" "$f"; then
+            echo "$f"
+            exit 0
+          fi
+        done
+      register: zscaler_ca
+      changed_when: false
+      failed_when: false
+
+    - name: "Install the Zscaler Root CA into the system trust store"
+      copy:
+        src: "{{ zscaler_ca.stdout_lines[0] }}"
+        dest: /usr/local/share/ca-certificates/zscaler-root-ca.crt
+        owner: root
+        group: root
+        mode: '0644'
+      when: zscaler_ca.stdout_lines | length > 0
+      register: zscaler_ca_copy
+
+    - name: "Rebuild the system CA bundle"
+      command: update-ca-certificates
+      when: zscaler_ca_copy is changed
+
+    - name: "Warn when no Zscaler Root CA was found"
+      debug:
+        msg: "WARNING: no Zscaler Root CA at {{ zscaler_ca_src }} or {{ zscaler_ca_share_glob }}; GitHub (iPXE update check) will fail TLS until it is installed."
+      when: zscaler_ca.stdout_lines | length == 0
+
+    - name: "Create webapp Updates state directory"
+      file:
+        path: /var/lib/pxe-webapp/updates
+        state: directory
+        owner: root
+        group: root
+        mode: '0755'
+
     # --- Web Management App (Flask) ---
     - name: "Create webapp directory"
       file: