Two-NIC standard: pin imaging and GE NICs by MAC everywhere

Every server has an imaging NIC (static, the only one that serves
DHCP/TFTP/HTTP boot/SMB) and a GE corporate NIC (DHCP client, SSH and the
webapp on 9009). The playbook guessed the PXE NIC and the installer put
172.16.9.1/24 on every en* NIC, so a two-NIC box could answer on the GE
network.

- New per-site vars pxe_nic_mac / corp_nic_mac (required, from
  playbook/site-vars.yml or -e; template site-vars.example.yml), stable
  names pxe_nic_name / corp_nic_name (default pxe0 / corp0, overridable),
  pxe_server_ip, pxe_subnet, DHCP range. pxe_imaging_mac / pxe_ge_mac are
  derived from them. The play stops before touching anything if a MAC is
  unset, malformed, duplicated or not on the box (lists the box's NICs).
- Heuristic NIC detection and the single-NIC netplan task replaced by a
  two-NIC netplan template (match macaddress + set-name), installed by
  pxe-netplan-apply.sh: validate in a scratch root, back up, generate,
  rename, apply, restore the previous config on any failure. cloud-init
  network config disabled so it cannot rewrite it.
- dnsmasq: /etc/dnsmasq.d/pxe-nic-only.conf from the vars (interface=,
  except-interface=, no-dhcp-interface=); dnsmasq.conf IP/range from vars.
- UFW per interface: imaging NIC 22, 67/udp, 69/udp, 80, 4433, 445, 139,
  137/udp, 138/udp, 9009; GE NIC 22 and 9009 only. Old any-interface rules
  and the stale 9011 rule removed after the new ones are in.
- sysctl drop-in: IPv4/IPv6 forwarding off; ip_nonlocal_bind so Apache
  can bind the imaging IP before the address is up.
- Samba [global]: interfaces = 127.0.0.0/8 <imaging NIC>, bind interfaces
  only. Apache 80 and 4433 on the imaging IP only; 9009 stays on all (TODO:
  the webapp has no auth).
- autoinstall: DHCP only on en*, no static 172.16.9.1; apt geoip off and
  offline-install fallback now that the corp NIC may have a lease.
- Blancco UEFI/Secure Boot: blancco_kver (7.0.0-34-generic) drives the
  kernel, initramfs and modules builds instead of the running kernel;
  outputs vmlinuz-ubuntu-70, kexec-initrd-70.img, kmod-<kver>.tar.gz as the
  menu and blancco-init.sh expect; creates: guards keyed on the full kver.
  Ubuntu's shimx64.efi.signed published as blancco/shimx64.efi.
  download-packages.sh adds shim-signed, linux-generic-hwe-24.04 and the
  pinned linux-image/modules/modules-extra for BLANCCO_KVER.

Rendered with the live MACs and names, netplan generate output is
identical to the live config; pxe-nic-only.conf and the Samba binding
match live directive for directive.

scripts/download-packages.sh

@@ -37,6 +37,7 @@ if [ "${IN_DOCKER:-}" != "1" ] && [ "$HOST_CODENAME" != "noble" ]; then
         -v "$REPO_DIR:/repo" \
         -v "$OUT_DIR_ABS:/out" \
         -e IN_DOCKER=1 \
+        -e BLANCCO_KVER="${BLANCCO_KVER:-}" \
         -w /repo \
         ubuntu:24.04 \
         bash -c "apt-get update -qq && apt-get install -y --no-install-recommends sudo python3-pip python3-setuptools python3-wheel ca-certificates >/dev/null && /repo/scripts/download-packages.sh /out"
@@ -50,6 +51,14 @@ fi
 
 mkdir -p "$OUT_DIR"
 
+# Kernel the Blancco UEFI path boots (playbook var blancco_kver; keep the two
+# in step). The playbook builds vmlinuz-ubuntu-70, kexec-initrd-70.img and
+# kmod-<kver>.tar.gz from this kernel's /boot and /lib/modules, and the
+# Canonical-signed image is what Ubuntu's shim starts with Secure Boot on.
+# The versioned packages pin it; the HWE metapackage keeps the box on the
+# HWE line. Override: BLANCCO_KVER=7.0.0-40-generic ./download-packages.sh
+BLANCCO_KVER="${BLANCCO_KVER:-7.0.0-34-generic}"
+
 # Packages installed by the Ansible playbook (pxe_server_setup.yml)
 PLAYBOOK_PACKAGES=(
     ansible
@@ -71,6 +80,12 @@ PLAYBOOK_PACKAGES=(
     sbsigntool
     zip
     curl
+    # Blancco with Secure Boot on: shimx64.efi.signed + the HWE kernel
+    shim-signed
+    linux-generic-hwe-24.04
+    "linux-image-${BLANCCO_KVER}"
+    "linux-modules-${BLANCCO_KVER}"
+    "linux-modules-extra-${BLANCCO_KVER}"
 )
 
 # Packages installed during autoinstall late-commands (NetworkManager, WiFi, etc.)