feature: Dell OEM configure (RMM-driven, internet-checked, no static policy)

[Gumbees]

Summary

Dell prototype in the new shape captured by the OEM redo design (#74) and the foundation PR (#75). Seeds src/oem-dell/ and src/oem-shared/lib/ with the four Dell leaves and three lib files. RMM-driven, internet-check at the install step only, no static .cctk policy file, # %INCLUDE markers for libs.

Stacked on #75. This PR targets feature/oem-redo-foundation. When the foundation PR merges to development, GitHub will auto-rebase this PR onto development and the diff stays clean.

What lands

Dell leaves (4 RMM-callable scripts)

• src/oem-dell/dell-configure.ps1 ... applies BIOS settings from $env:BIOS_* env vars via the Dell translation table. No static policy file. Each setting is its own cctk invocation so one bad value doesn't fail the rest. Handles $env:BIOS_AdminPassword (current) and $env:BIOS_AdminPasswordNew (set/change). Logs applied / skipped / failed summary. Exit 0 on full success, 1 on any failure, 2 if cctk is missing.
• src/oem-dell/dell-command-update-install.ps1 ... idempotent DCU install. Internet check at the top ... bails clean (exit 0) if offline so DCU already-installed endpoints keep working through dell-command-update-run. Version-gates against $env:DCUTargetVersion (default 5.7.0).
• src/oem-dell/dell-command-update-run.ps1 ... /scan then /applyUpdates -autoSuspendBitLocker=enable -reboot=disable. No internet check ... operates on installed DCU. Returns DCU's exit code (0=success, 1=reboot required, 2-8=documented error codes). $env:DCUScanOnly=1 stops after scan.
• src/oem-dell/dell-debloat.ps1 ... removes Dell consumer software (SupportAssist, Dell Update, Mobile Connect, Digital Delivery, Customer Connect, MyDell). Keeps Dell Command Update and Dell Command Configure (the vendor lifecycle tools). Handles both MSI and EXE uninstallers and provisioned AppX bundles.

Shared libs (inlined at CI build time)

• src/oem-shared/lib/oem-manufacturer-detect.ps1 ... Get-OEMManufacturer returning "Dell" / "HP" / "Lenovo" / "Unknown". Used by every OEM leaf for the self-skip-on-wrong-hardware pattern.
• src/oem-dell/lib/dell-detection.ps1 ... Test-DellHardware, Get-DellInstalledModel, Test-DCUInstalled, Get-DCUVersion, Get-DCUCliPath. Adapted from the closed feature(oem): OEM hybrid management pattern + Dell prototype #69 (knowledge preserved, runtime-fetch shape dropped).
• src/oem-dell/lib/dell-bios-translation.ps1 ... $script:DellBiosSettingsMap mapping the canonical $env:BIOS_* names in CLAUDE.md to Dell cctk syntax. Covers the seven core canonical settings (TPM enabled/activation, SecureBoot, VirtualizationCPU/IOMMU, WakeOnLAN, BootMode). Easy to extend ... add a row to the map.

How leaves consume libs

Top of each leaf:

# %INCLUDE src/oem-shared/lib/oem-manufacturer-detect.ps1
# %INCLUDE src/oem-dell/lib/dell-detection.ps1
# %INCLUDE src/oem-dell/lib/dell-bios-translation.ps1

CI inlines them at build time per #75. No runtime fetch, no hash pinning, no LibTag env var, no lib-bootstrap block.

Variance from the task brief

• No dell-bios-config.ps1 separate leaf. Folded the BIOS-config logic into dell-configure.ps1. The foundation CLAUDE.md and foundation-author's brief both name <oem>-configure.ps1 as the script that applies BIOS settings, and with fat-script CI there's no runtime mechanism for one leaf to invoke another. The four-leaf structure (configure, dcu-install, dcu-run, debloat) matches CLAUDE.md exactly and the RMM is the orchestrator (four presets, one per leaf).
• No shared src/oem-shared/lib/internet-check.ps1 or src/oem-shared/lib/bios-settings.ps1. CLAUDE.md treats the internet-check as a small inline function pattern (see the commented stub in script-template-powershell.ps1) and treats BIOS translation as per-OEM. Avoids splitting tiny helpers into shared libs prematurely. If HP / Lenovo prototypes show real duplication, those can be promoted to oem-shared in Phase 3 with their builders' input.

Knowledge preserved from PR #69 (closed)

• DCU CLI canonical path: $env:ProgramFiles\Dell\CommandUpdate\dcu-cli.exe
• DCU /applyUpdates exit-code mapping (0..8) with documented meanings
• DCU CLI flags -autoSuspendBitLocker=enable -reboot=disable for safe RMM-mode runs
• Dell consumer software list + keep-list (Command Update / Command Configure)
• cctk path candidates (X86_64 and X86 subfolders under Dell\Command Configure)
• AppX provisioned-package patterns for Dell consumer SKUs
• BIOS admin password handling via --valsetuppwd=<current> and --setuppwd=<new>

What did NOT carry over from #69

• Runtime lib-bootstrap block (replaced by # %INCLUDE)
• SHA-256 hash placeholders (no runtime fetch = no hash verification needed)
• $env:LibTag var (no runtime fetch = no tag selection)
• Invoke-DellLeaf orchestrator that ran sub-scripts as separate processes (RMM is the orchestrator now)
• dell-baseline.ps1 name (renamed to dell-configure.ps1 per CLAUDE.md)
• Static .cctk policy file URL fetch (BIOS settings now operator-set via $env:BIOS_* env vars)

TODOs (real-endpoint data only)

The new pattern doesn't need SHA placeholders, so the only TODOs are for data that has to come from a real endpoint or a real download:

• dell-command-update-install.ps1 ... confirm the canonical Dell-hosted EXE URL for DCU 5.7 Classic from https://www.dell.com/support/kbdoc/en-us/000177325/dell-command-update against a fresh manual download. The placeholder https://dl.dell.com/FOLDER/Dell-Command-Update-Application_WIN_5.7.0_A00.EXE follows Dell's published download path pattern but needs the actual folder ID captured.
• dell-command-update-run.ps1 ... add any additional exit codes observed during real-endpoint testing (DCU has occasionally emitted undocumented codes on edge-case hardware).
• dell-configure.ps1 ... map cctk exit codes observed during real-endpoint testing (e.g. password-required, setting-unsupported-on-model) to friendlier messages.

Test plan

• Local build ... .github/scripts/build-fat-scripts.ps1 produces 7 fat scripts with proper # === inlined from ... === framing.
• Parse check ... all 7 fat scripts parse cleanly via [Parser]::ParseFile.
• Smoke (non-Dell host) ... all 4 leaves exit 0 with "Not a Dell endpoint" on the dev workstation.
• CI build ... after merge to development, workflow produces fat scripts on published and moves @dev tag.
• DCU install on real Dell endpoint ... confirm canonical Dell URL works; capture installer behavior + any exit-code quirks.
• DCU run on real Dell endpoint ... confirm scan + applyUpdates exit codes match the documented set.
• BIOS config on real Dell endpoint ... test each $env:BIOS_* setting individually with and without $env:BIOS_AdminPassword; observe cctk exit codes for unsupported settings.
• Debloat on real Dell consumer SKU ... verify the AppX + MSI / EXE paths complete without removing Command Update / Command Configure.

Follow-ups

• HP prototype (feature(oem): replicate OEM hybrid pattern for HP #70, separate PR) once Dell is endpoint-validated ... mirrors this shape.
• Lenovo prototype (feature(oem): replicate OEM hybrid pattern for Lenovo #71, separate PR) ... same.
• Promote translation maps to oem-shared/lib/ if HP + Lenovo show meaningful duplication.

[claude]

⚠️ Code review skipped — your organization's overage spend limit has been reached.

Code review is billed via overage credits. To resume reviews, an organization admin can raise the monthly limit at claude.ai/admin-settings/claude-code.

Once credits are available, push a new commit or reopen this pull request to trigger a review.

[Gumbees]

Closing in favor of a design refinement on #74. After review, the CI fat-script build pipeline (src/ + published/ branch + # %INCLUDE markers + GHA assembly) is overengineered for this repo's scale (~12 scripts that'd benefit from shared helpers, 5 contributors). The build-system costs (custom marker syntax, branch choreography, two trees to grep when debugging, GHA as a critical path) outweigh the DRY-at-source benefit at current size.

Replacing with self-contained scripts: each OEM script inlines its own OEM detection + BIOS translation table + any other helpers it needs. ~30-50 lines duplicated across Dell + HP + Lenovo. Acceptable, easy to grep, no build system to operate.

The genuinely-good pieces of the prior design are being preserved in the new shape:

• configure naming (not baseline)
• $env:BIOS_* canonical settings with per-OEM translation tables
• Internet check at install step only
• Per-OEM script shape: *-configure.ps1 / *-command-update-install.ps1 / *-command-update-run.ps1 / *-debloat.ps1

Branch retained for cherry-pick reference. New Dell PR coming as a fresh PR targeting development.