Two-NIC standard: pin imaging and GE NICs by MAC everywhere

Every server has an imaging NIC (static, the only one that serves
DHCP/TFTP/HTTP boot/SMB) and a GE corporate NIC (DHCP client, SSH and the
webapp on 9009). The playbook guessed the PXE NIC and the installer put
172.16.9.1/24 on every en* NIC, so a two-NIC box could answer on the GE
network.

- New per-site vars pxe_nic_mac / corp_nic_mac (required, from
  playbook/site-vars.yml or -e; template site-vars.example.yml), stable
  names pxe_nic_name / corp_nic_name (default pxe0 / corp0, overridable),
  pxe_server_ip, pxe_subnet, DHCP range. pxe_imaging_mac / pxe_ge_mac are
  derived from them. The play stops before touching anything if a MAC is
  unset, malformed, duplicated or not on the box (lists the box's NICs).
- Heuristic NIC detection and the single-NIC netplan task replaced by a
  two-NIC netplan template (match macaddress + set-name), installed by
  pxe-netplan-apply.sh: validate in a scratch root, back up, generate,
  rename, apply, restore the previous config on any failure. cloud-init
  network config disabled so it cannot rewrite it.
- dnsmasq: /etc/dnsmasq.d/pxe-nic-only.conf from the vars (interface=,
  except-interface=, no-dhcp-interface=); dnsmasq.conf IP/range from vars.
- UFW per interface: imaging NIC 22, 67/udp, 69/udp, 80, 4433, 445, 139,
  137/udp, 138/udp, 9009; GE NIC 22 and 9009 only. Old any-interface rules
  and the stale 9011 rule removed after the new ones are in.
- sysctl drop-in: IPv4/IPv6 forwarding off; ip_nonlocal_bind so Apache
  can bind the imaging IP before the address is up.
- Samba [global]: interfaces = 127.0.0.0/8 <imaging NIC>, bind interfaces
  only. Apache 80 and 4433 on the imaging IP only; 9009 stays on all (TODO:
  the webapp has no auth).
- autoinstall: DHCP only on en*, no static 172.16.9.1; apt geoip off and
  offline-install fallback now that the corp NIC may have a lease.
- Blancco UEFI/Secure Boot: blancco_kver (7.0.0-34-generic) drives the
  kernel, initramfs and modules builds instead of the running kernel;
  outputs vmlinuz-ubuntu-70, kexec-initrd-70.img, kmod-<kver>.tar.gz as the
  menu and blancco-init.sh expect; creates: guards keyed on the full kver.
  Ubuntu's shimx64.efi.signed published as blancco/shimx64.efi.
  download-packages.sh adds shim-signed, linux-generic-hwe-24.04 and the
  pinned linux-image/modules/modules-extra for BLANCCO_KVER.

Rendered with the live MACs and names, netplan generate output is
identical to the live config; pxe-nic-only.conf and the Samba binding
match live directive for directive.

playbook/templates/dnsmasq-pxe-nic-only.conf.j2

@@ -0,0 +1,8 @@
+# Managed by pxe_server_setup.yml (vars pxe_nic_name, corp_nic_name).
+# Pin dnsmasq to the imaging NIC. Without it the box offers PXE/DHCP on the
+# GE corporate LAN the moment that cable is plugged in. Works together with
+# port=0 / listen-address / bind-dynamic in /etc/dnsmasq.conf and the
+# pxe-nic-check guard (docs/pxe-nic-guard.md).
+interface={{ pxe_nic_name }}
+except-interface={{ corp_nic_name }}
+no-dhcp-interface={{ corp_nic_name }}

playbook/templates/netplan-pxe.yaml.j2

@@ -0,0 +1,28 @@
+# Managed by pxe_server_setup.yml (vars pxe_nic_mac, corp_nic_mac,
+# pxe_nic_name, corp_nic_name, pxe_server_ip, pxe_subnet). Local edits are
+# replaced on the next playbook run; the previous file is kept under
+# /var/backups/netplan-<timestamp>/.
+#
+# Two NICs, each matched by MAC and given a stable name:
+#   pxe-lan  imaging LAN, static, no gateway, no DNS. The ONLY NIC that
+#            serves DHCP/TFTP/HTTP boot/SMB.
+#   ge-corp  GE corporate network, DHCP client (SSH + webapp 9009, updates).
+network:
+  version: 2
+  renderer: networkd
+  ethernets:
+    pxe-lan:
+      match:
+        macaddress: "{{ pxe_nic_mac | lower }}"
+      set-name: {{ pxe_nic_name }}
+      dhcp4: false
+      dhcp6: false
+      addresses:
+        - {{ pxe_server_ip }}/{{ pxe_prefix }}
+    ge-corp:
+      match:
+        macaddress: "{{ corp_nic_mac | lower }}"
+      set-name: {{ corp_nic_name }}
+      dhcp4: true
+      dhcp4-overrides:
+        route-metric: {{ corp_route_metric }}