design: OEM hybrid pattern redo (CI fat scripts, configure-not-baseline, RMM-driven options)

[Gumbees]

Why the redo

The original OEM hybrid pattern (PRs #69, #72, #73) shipped four design choices that didn't survive review:

1. Lib bootstrap via runtime jsDelivr fetch with REPLACE_WITH_REAL_HASH placeholders ... no workflow captured the hashes, scripts shipped broken-by-design.
2. "baseline" naming implied static repo-side configuration when the desired state actually lives in the RMM operator's hands.
3. Static .cctk / .repset / WMI policy files in the repo were customer-fragile and couldn't be overridden per-endpoint.
4. No internet check ... scripts assumed connectivity for the bootstrap, would fail opaquely on offline endpoints.

New design

Fat scripts via CI

• Source files live in src/ ... modular, reference shared lib code via # %INCLUDE oem-shared/lib/<name>.ps1 marker comments.
• GHA workflow on push to development and main walks src/, inlines lib content per # %INCLUDE marker, outputs fat self-contained scripts to a separate published branch.
• NinjaRMM script URLs pin to jsDelivr against the published branch at a specific commit SHA, or at @release tag for prod.
• No runtime lib fetch. No SHA placeholders. Each script is self-contained except for the actual vendor binary download.

Internet check at the install step only

• Install leaves (DCU install, HPIA install, LSU install) check internet before pulling the vendor binary; skip cleanly on offline (log + exit 0).
• Configure / BIOS / debloat leaves don't need internet ... they operate on what's already installed.

Configure not baseline

• Rename <oem>-baseline.ps1 -> <oem>-configure.ps1. The RMM operator's env var set is the desired state.
• All BIOS settings come from $env:BIOS_* env vars via a canonical translation table (shared across OEMs).
• No static policy files in the repo. Per-customer or per-endpoint config is operator-set.

Phasing

• Phase 1: Foundation PR ... CI workflow, src/ structure, build step, revised docs.
• Phase 2: Dell configure prototype in the new shape.
• Phase 3: HP + Lenovo replication in parallel once Dell is endpoint-validated.

Out of scope

• Per-customer policy multiplexing beyond RMM env vars (future enhancement).
• Microsoft Surface support (not enough fleet to justify yet).
• Wave-deployment integration (separate concern).

[Gumbees]

Design refinement: dropping the CI fat-script build system (custom # %INCLUDE markers + src//published/ branch + GHA assembly) as overengineered for this repo's scale. Self-contained scripts with inlined helpers are the simpler path that still ships the good parts: configure naming, env-var-driven BIOS settings with per-OEM translation tables, internet check at install step only.

PRs #75 and #76 closed. New Dell PR coming as self-contained scripts at the repo root (no src/).