feature: Lenovo OEM hybrid pattern (LSU + WMI BIOS + debloat)

[Gumbees]

Summary

Replicates the Dell OEM hybrid pattern (PR #69) for Lenovo. LSU is the public default (no Lenovo Partner Hub enrollment required), BIOS config goes through WMI (Lenovo has no cctk-equivalent CLI), and the debloat keep-list protects LSU and Lenovo enterprise security agents but removes consumer Vantage.

Closes #71.

Files added

• oem-lenovo/lenovo-baseline.ps1 ... orchestrator, mirrors dell-baseline.ps1
• oem-lenovo/lenovo-system-update-install.ps1 ... installs Lenovo System Update 5.08.03.59 via Inno Setup /verysilent /norestart
• oem-lenovo/lenovo-system-update-run.ps1 ... runs Tvsu.exe /CM -search A -action INSTALL -includerebootpackages 1,3,4 -noreboot -nolicense -noicon
• oem-lenovo/lenovo-bios-config.ps1 ... applies name,value policy via Lenovo_SetBiosSetting + Lenovo_SaveBiosSettings (root\wmi)
• oem-lenovo/lenovo-debloat.ps1 ... removes consumer Lenovo Vantage / Smart Communication / Smart Privacy / Smart Appearance / Voice / Now / Welcome / Migration Assistant / McAfee bundles + provisioned AppX (E0469640.*, LenovoCorporation.LenovoVantage)
• oem-lenovo/lib/lenovo-detection.ps1 ... Test-LenovoHardware, Get-LenovoInstalledModel (SystemFamily), Get-LenovoMachineType, Test-LSUInstalled, Get-LSUVersion, Get-LSUCliPath

Lib bootstrap pattern

Uses the new commit-SHA-pinned pattern (no Sha256 field, no REPLACE_WITH_REAL_HASH placeholder). Libs pinned to 5b1b16c4b19816343145138941c3c5fa51a095e8 (current origin/development HEAD). # TODO: bump SHA when oem-shared/lib or oem-lenovo/lib changes near each $libBaseUrl.

Lenovo-specific divergence from Dell pattern

• No CLI BIOS tool. BIOS config goes through Lenovo_SetBiosSetting / Lenovo_SaveBiosSettings (WMI). Policy file format is one name,value tuple per line (# for comments), parsed in PowerShell, looped per setting, then Lenovo_SaveBiosSettings commits once at the end.
• Supervisor password tuple. When $env:LenovoBiosSupervisorPassword is set, the tuple becomes Name,Value,<pwd>,ascii,us per the Lenovo CDRT WMI BIOS guide.
• Test-LenovoHardware uses Win32_ComputerSystem.Manufacturer -like "LENOVO*" (uppercase per Lenovo firmware convention).
• Model reporting uses SystemFamily (e.g. "ThinkPad T14") for the Ninja custom field. Model is exposed separately as the 4-char machine-type prefix via Get-LenovoMachineType.
• Exit codes. Lenovo's Tvsu.exe exit code documentation is thin. Current mapping is 0 = success, non-zero = error, with a session.xml stub for post-run parsing once the schema is confirmed on a live endpoint. (Dell's DCU has a full documented exit code table; LSU does not.)

Commercial Vantage stub

$env:LenovoVantageCommercialAvailable = "1" is documented in the baseline header but the branch is not implemented. The orchestrator currently emits Write-Host "LenovoVantageCommercialAvailable=1: Commercial Vantage path not yet implemented; falling back to LSU" and continues down the LSU path. A # TODO: Commercial Vantage opt-in path comment in lenovo-baseline.ps1 marks the spot for the future swap.

TODOs captured in code

• Confirm direct Lenovo CDN URL + capture SHA256 for system_update_5.08.03.59.exe
• Capture SHA256 for dtc-baseline.lenovobios once that policy file is authored (NOT included in this PR)
• Document Tvsu.exe exit code map after endpoint testing
• Confirm Lenovo_SaveBiosSettings("") no-password call succeeds on test endpoint (older models may require a tuple even with empty password)
• Parse %PROGRAMDATA%\Lenovo\SystemUpdate\session.xml for the Ninja custom field summary
• Implement Commercial Vantage install + run path when DTC enrolls in Lenovo Partner Hub

Test plan

• Run lenovo-baseline.ps1 on a real Lenovo ThinkPad endpoint with $env:RMM=0 (interactive)
• Confirm Test-LenovoHardware returns true (uppercase manufacturer match)
• Confirm LSU install path resolves correctly (${env:ProgramFiles(x86)}\Lenovo\System Update\Tvsu.exe ... 32-bit vs 64-bit Program Files variation)
• Confirm Tvsu.exe /CM -search A -action INSTALL -includerebootpackages 1,3,4 installs reboot-required packages (without this flag, BIOS and firmware are skipped)
• Confirm Lenovo_SetBiosSetting + Lenovo_SaveBiosSettings round-trip on a test endpoint with no supervisor password
• Confirm debloat removes consumer Vantage (LenovoCorporation.LenovoVantage) but keeps Commercial Vantage (LenovoCorporation.LenovoSettings) when both happen to be present
• Confirm the LSU installer URL still resolves (Lenovo CDN URLs are timestamped)
• Confirm a non-Lenovo endpoint exits cleanly (exit 0, Ninja custom field "Skipped: not Lenovo")

[claude]

⚠️ Code review skipped — your organization's overage spend limit has been reached.

Code review is billed via overage credits. To resume reviews, an organization admin can raise the monthly limit at claude.ai/admin-settings/claude-code.

Once credits are available, push a new commit or reopen this pull request to trigger a review.

[Gumbees]

Closing in favor of the OEM redo design captured at #74. The original approach (runtime lib bootstrap via jsDelivr, "baseline" naming with static policy files, hash placeholders) is being replaced with CI-generated fat scripts, internet check only at the install step, and RMM-env-var-driven configure scripts. New PRs will be opened against the foundation PR (separate, coming next).

Branch retained ... cherry-pick anything worth preserving from the new PR's branch.