feature: HP OEM hybrid pattern (HPIA + BCU + debloat)

[Gumbees]

Summary

Replicates the OEM hybrid pattern (orchestrator + vendor-tool leaves + inline-config leaves with jsDelivr lib bootstrap and SHA256 verification) for HP, following the Dell prototype landed in #69.

Closes #70.

Components

• oem-hp/hp-baseline.ps1 ... orchestrator. Detects manufacturer, fetches and invokes each enabled leaf from jsDelivr, reports status to a Ninja custom field.
• oem-hp/hp-image-assistant-install.ps1 ... idempotent HPIA install. Downloads hp-hpia-<version>.exe, verifies SHA256, runs /s, verifies version post-install.
• oem-hp/hp-image-assistant-run.ps1 ... /Operation:Analyze /Action:Install /Category:Drivers,Software,Firmware,BIOS /Selection:All /Silent with /ReportFolder and /SoftpaqDownloadFolder set to C:\ProgramData\DTC\HPIA\. Parses HPIA exit codes (0/256/257/3010 = success, 4096/4097/8194/8199 = failure).
• oem-hp/hp-bios-config.ps1 ... fetches dtc-baseline.repset from jsDelivr, applies via BiosConfigUtility64.exe /setconfig:... /log:..., supports optional password file via /cspwdfile.
• oem-hp/hp-debloat.ps1 ... removes HP consumer software (Support Assistant, JumpStart, Wolf Security, Connection Optimizer, etc.) and the AD2F1837.* provisioned AppX bundles. Keep-list protects HPIA, HP CMSL, BCU, Client Security Manager, and System Default Settings.
• oem-hp/lib/hp-detection.ps1 ... Test-HPHardware (covers HP* and Hewlett* manufacturer strings), Get-HPInstalledModel, Test-HPIAInstalled, Get-HPIAVersion, Get-HPIAPath, Get-HPBCUPath.

Reuses the shared helpers from #69 (Get-OEMManufacturer, Get-VerifiedDownload) at oem-shared/lib/oem-manufacturer-detect.ps1. No new shared helpers added.

Conventions held

• $env:VAR contract everywhere; $env:RMM compared against "1".
• Three-section structure (RMM vars / input handling / script logic).
• Start-Transcript / Stop-Transcript with the $TranscriptStarted guard pattern (Fix Stop-Transcript error when transcript not active #34).
• camelCase variables, kebab-case filenames.
• No em dashes in script comments, no AI tells.

TODOs captured in code

Each is marked with an explicit # TODO: comment in the file that needs it.

• hp-image-assistant-install.ps1 ... confirm canonical HPIA EXE URL on the HPIA index page; capture SHA256 of hp-hpia-5.3.4.exe into $env:HPIAInstallerSha256.
• hp-bios-config.ps1 ... author oem-hp/policy/dtc-baseline.repset by exporting from a known-good HP with BiosConfigUtility64.exe /getconfig:current.repset, editing the active-value markers (*) to the DTC baseline, and committing at that path. Capture its SHA256 into $env:HPBiosPolicySha256.
• All lib-bootstrap blocks and leaf-invoke calls in hp-baseline.ps1 ... replace REPLACE_WITH_REAL_HASH placeholders once the libs and leaves land on the @release tag (same pattern as the Dell PR).

Verification

• [System.Management.Automation.Language.Parser]::ParseFile passes clean on all six scripts (no syntax errors, no parse warnings).
• Grep for [—–] (em / en dash) across oem-hp/ returns no matches.
• File shape and conventions visually diffed against the Dell prototype at origin/feature/oem-hybrid-pattern-dell.

Notes for follow-up testing on a live HP endpoint

• Validate HPIA install path resolves to C:\Program Files\HP\HPIA\ (some installer versions have landed at C:\Program Files (x86)\HP\HPIA\; the detection lib checks both).
• Validate BCU install path resolves correctly (lib checks both Hewlett-Packard and HP subfolders under Program Files and Program Files (x86)).
• Confirm exit codes 257 vs 3010 behave as expected on a machine with pending updates.
• Capture all SHA256 TODOs into the lib-bootstrap pinning before tagging @release.

[claude]

⚠️ Code review skipped — your organization's overage spend limit has been reached.

Code review is billed via overage credits. To resume reviews, an organization admin can raise the monthly limit at claude.ai/admin-settings/claude-code.

Once credits are available, push a new commit or reopen this pull request to trigger a review.

[Gumbees]

Closing in favor of the OEM redo design captured at #74. The original approach (runtime lib bootstrap via jsDelivr, "baseline" naming with static policy files, hash placeholders) is being replaced with CI-generated fat scripts, internet check only at the install step, and RMM-env-var-driven configure scripts. New PRs will be opened against the foundation PR (separate, coming next).

Branch retained ... cherry-pick anything worth preserving from the new PR's branch.