startnet.cmd: stage udc-backups to WinPE; mirror-from-gold: taxonomy layout

- playbook/startnet.cmd + startnet-template.cmd: after preinstall staging,
  xcopy Y:\pre-install\udc-backups to W:\PreInstall\udc-backups so UDC
  settings JSONs are available during image deployment. Harvested from
  live gold where this block existed but was never committed.

- scripts/mirror-from-gold.sh: update source paths to current taxonomy
  layout (pre-install/, installers-post/, blancco/, config/) and add
  ppkgs/, scripts/, shopfloor-setup/ sections. Added --delete for exact
  mirror semantics. Used to seed the spare PXE server at 10.9.100.2 on
  2026-04-16 from gold at 10.9.100.1.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/mirror-from-gold.sh

@@ -7,9 +7,9 @@
 # It pulls Operating Systems, drivers, packages, custom installers, and
 # Blancco assets that are NOT bundled on the USB installer.
 #
-# Source paths on GOLD use the legacy flat enrollment layout. Destination
-# paths on the new server use the reorganized layout (ppkgs/, scripts/,
-# config/, pre-install/, installers-post/, blancco/, etc).
+# GOLD is on the taxonomy layout (pre-install/, installers-post/, blancco/,
+# config/, ppkgs/, scripts/, shopfloor-setup/). Source and destination paths
+# are identical per section, so sections can be added trivially as GOLD grows.
 #
 # Usage:
 #   sudo ./mirror-from-gold.sh <GOLD_IP> [options]
@@ -98,7 +98,7 @@ mirror() {
     echo "  src:  pxe@$GOLD:$src"
     echo "  dest: $dest"
     mkdir -p "$dest"
-    rsync -aHl --info=progress2 --no-inc-recursive $DRY_RUN "$@" \
+    rsync -aHl --delete --info=progress2 --no-inc-recursive $DRY_RUN "$@" \
         -e "$RSH" \
         "pxe@$GOLD:$src" "$dest" || \
         echo "  WARNING: rsync exited rc=$? (likely a permissions issue on source); continuing"
@@ -138,36 +138,44 @@ for img in gea-standard gea-engineer gea-shopfloor; do
         --exclude=backup --exclude=logs --exclude='New folder' --exclude=ProMax
 done
 
-# ---------- Enrollment-share content with path translation (flat -> taxonomy) ----------
+# ---------- Enrollment-share content (GOLD is on taxonomy layout, src == dest) ----------
 
-# Preinstall installers (adobe, opentext, drivers, display, vcredist, UDC, Oracle, etc.)
-mirror "Pre-install installers" \
-    "/srv/samba/enrollment/preinstall/installers/" \
-    "/srv/samba/enrollment/pre-install/installers/" \
+# Pre-install: installers + bios + preinstall.json + udc-backups
+mirror "Pre-install tree" \
+    "/srv/samba/enrollment/pre-install/" \
+    "/srv/samba/enrollment/pre-install/" \
     --exclude='*.old'
 
-# CMM installers (PCDMIS) - flat dir on GOLD becomes installers-post/cmm/
-mirror "CMM installers (PCDMIS)" \
-    "/srv/samba/enrollment/cmm-installers/" \
-    "/srv/samba/enrollment/installers-post/cmm/"
+# Post-install installers (CMM PC-DMIS, etc.)
+mirror "Post-install installers" \
+    "/srv/samba/enrollment/installers-post/" \
+    "/srv/samba/enrollment/installers-post/"
 
-# Blancco custom image - flat file on GOLD becomes blancco/<file>
-echo
-echo "==== Blancco custom image ===="
-mkdir -p /srv/samba/enrollment/blancco
-rsync -aHl --info=progress2 $DRY_RUN \
-    -e "$RSH" \
-    "pxe@$GOLD:/srv/samba/enrollment/BDE715_GEAE_INTERNET.img.gz" \
+# Blancco custom image
+mirror "Blancco images" \
+    "/srv/samba/enrollment/blancco/" \
     "/srv/samba/enrollment/blancco/"
 
-# Site-specific config file
-echo
-echo "==== Site config (site-config.json) ===="
-echo "  Verifying GOLD's copy is more recent than playbook default..."
-rsync -avhl $DRY_RUN -e "$RSH" \
-    "pxe@$GOLD:/srv/samba/enrollment/site-config.json" \
-    "/srv/samba/enrollment/config/site-config.json" 2>/dev/null || \
-    echo "  (no site-config.json at flat path on GOLD - skipping)"
+# Site config (site-config.json, etc.)
+mirror "Enrollment config" \
+    "/srv/samba/enrollment/config/" \
+    "/srv/samba/enrollment/config/"
+
+# Provisioning packages
+mirror "PPKGs" \
+    "/srv/samba/enrollment/ppkgs/" \
+    "/srv/samba/enrollment/ppkgs/"
+
+# Enrollment scripts (run-enrollment.ps1, startnet.cmd, etc.)
+mirror "Enrollment scripts" \
+    "/srv/samba/enrollment/scripts/" \
+    "/srv/samba/enrollment/scripts/" \
+    --exclude='*.pre-*'
+
+# Shopfloor-setup tree (per-PC-type scripts + site-config)
+mirror "Shopfloor-setup tree" \
+    "/srv/samba/enrollment/shopfloor-setup/" \
+    "/srv/samba/enrollment/shopfloor-setup/"
 
 # Permissions: anything we just created should be readable by the share
 chown -R root:root /srv/samba/enrollment /srv/samba/winpeapps