feature(oem): OEM hybrid management pattern + Dell prototype

[Gumbees]

Summary

Lands the OEM hybrid management pattern with Dell as the prototype implementation. The pattern splits OEM endpoint management into two layers:

• Vendor lifecycle tools for drivers, firmware, and BIOS updates (Dell Command Update). Deployed once, run on schedule.
• Inline scripts for one-shot configs (BIOS settings via cctk, consumer debloat).

Phase 1 (this PR): the shape + the Dell side. Phase 2 (separate issues): HP + Lenovo replications.

Shape

oem-shared/lib/oem-manufacturer-detect.ps1   # Get-OEMManufacturer, Get-VerifiedDownload
oem-dell/
  dell-baseline.ps1                          # orchestrator
  dell-command-update-install.ps1            # idempotent DCU install
  dell-command-update-run.ps1                # DCU /scan + /applyUpdates
  dell-bios-config.ps1                       # cctk policy push
  dell-debloat.ps1                           # remove Dell consumer software
  lib/dell-detection.ps1                     # Test-DellHardware, Get-DCUVersion, etc.

The orchestrator (dell-baseline.ps1) is the only script NinjaRMM is expected to schedule. It detects the manufacturer, exits cleanly on non-Dell hardware, and gates each leaf behind an RMM env var (RunDCUInstall, RunDCURun, RunDellBiosConfig, RunDellDebloat). Status flows to a Ninja text custom field (dellBaselineStatus by default).

Each leaf is also independently runnable. NinjaRMM downloads one script (the orchestrator or a leaf); shared libs are pulled at runtime from jsDelivr at the @release tag and SHA256-verified before dot-sourcing. Bootstrap shape follows PR #68.

Conventions followed

• Targets development per the new default branch.
• $env:VAR contract for every RMM-supplied variable; $env:RMM compared against string "1".
• Three-section structure (RMM vars / input handling / script logic) from script-template-powershell.ps1.
• Start-Transcript / Stop-Transcript with the $TranscriptStarted guard from PR Fix Stop-Transcript error when transcript not active #34.
• feature/ branch prefix per the four-prefix taxonomy (Change Taxonomy).
• camelCase variables, kebab-case filenames, category-vendor folder names.

Research confirmed

• DCU latest stable: 5.7 (released April 2026), Driver IDs FGK9X (UWP) and RXT5N (Classic). Source: Dell KB 000177325.
• Silent install flag: /s (with optional /l=<path> for log). Source: DCU 5.x silent install guide.
• dcu-cli.exe lives at %ProgramFiles%\Dell\CommandUpdate\dcu-cli.exe. Exit codes for /applyUpdates parsed into human strings in the run script (Source: DCU 5.x reference).
• cctk.exe ships with Dell Command Configure at %ProgramFiles%\Dell\Command Configure\X86_64\cctk.exe (or X86 on 32-bit). Policy applied with --infile=<path> (Source: DCC 4.1 user guide).
• Dell consumer software patterns confirmed: SupportAssist, Dell Update, Dell Mobile Connect, Dell Digital Delivery, MyDell. AppX side covers DellInc.DellMobileConnect, DellInc.MyDell, etc.

TBD (TODO markers in code)

These are all pinned with REPLACE_WITH_REAL_HASH placeholders and explicit TODO comments. They need to be captured once the libs and policy file land on the @release tag and the canonical DCU installer URL is locked in.

• SHA256 of oem-shared/lib/oem-manufacturer-detect.ps1 at @release.
• SHA256 of oem-dell/lib/dell-detection.ps1 at @release.
• SHA256 of each leaf script at @release (orchestrator fetches them by URL + hash).
• Canonical DCU 5.7 Classic installer URL ... Dell's KB page links to the driver detail page, not a direct dl.dell.com URL. Real URL needs to be captured from the FGK9X/RXT5N driver page and pinned, then SHA256'd.
• oem-dell/policy/dtc-baseline.cctk ... the policy file itself doesn't exist yet. Author it from Dell Command Configure GUI on a reference endpoint, commit it, capture its SHA256.
• DCU installer SHA256 once the URL is locked in.

Test plan

Manual on a Dell endpoint (no DTC-managed Dell available to me at PR-open time):

• dell-baseline.ps1 on a non-Dell endpoint exits 0 with "Skipped: not Dell" status.
• dell-baseline.ps1 on a Dell endpoint with no DCU installed triggers dell-command-update-install.ps1, verifies install, runs dell-command-update-run.ps1.
• dell-command-update-install.ps1 is idempotent: second run finds DCU at target version, skips.
• dell-command-update-run.ps1 returns the correct exit code (0 success, 1 reboot required) and the run-script parses the code into a human string.
• dell-debloat.ps1 removes SupportAssist and Dell Mobile Connect; leaves Dell Command Update + Dell Command Configure installed.
• dell-bios-config.ps1 applies a test .cctk file via cctk.
• Lib bootstrap fetches both libs from jsDelivr and SHA256-verifies before dot-sourcing (will need the real hashes pinned first).
• NinjaRMM custom field dellBaselineStatus updates after a baseline run.

Follow-ups

Two issues filed to replicate this pattern:

• HP: HP Image Assistant + BIOS Configuration Utility, HP-specific debloat.
• Lenovo: Lenovo Vantage Commercial / System Update, ThinkBIOSConfig, Lenovo-specific debloat.

Both issues reference this PR as the canonical prototype.

[claude]

⚠️ Code review skipped — your organization's overage spend limit has been reached.

Code review is billed via overage credits. To resume reviews, an organization admin can raise the monthly limit at claude.ai/admin-settings/claude-code.

Once credits are available, push a new commit or reopen this pull request to trigger a review.

[Gumbees]

Closing in favor of the OEM redo design captured at #74. The original approach (runtime lib bootstrap via jsDelivr, "baseline" naming with static policy files, hash placeholders) is being replaced with CI-generated fat scripts, internet check only at the install step, and RMM-env-var-driven configure scripts. New PRs will be opened against the foundation PR (separate, coming next).

Branch retained ... cherry-pick anything worth preserving from the new PR's branch.