feature(oem): Dell OEM hybrid pattern (self-contained scripts)

[Gumbees]

Summary

Replaces the now-closed #75 (foundation) and #76 (Dell with src/ structure) with self-contained Dell OEM scripts at the repo root. Single PR against development.

Per the design refinement on #74: the CI fat-script build system (src/ + published/ branch + # %INCLUDE markers + GHA assembly) was overengineered for this repo's scale (~12 scripts that'd benefit from shared helpers, 5 contributors). Self-contained scripts with inlined helpers are the simpler path. ~30-50 lines duplicated across Dell + HP + Lenovo is the accepted trade.

Carried forward from the prior design (the genuinely-good parts):

• configure naming, not baseline
• $env:BIOS_* canonical settings with per-OEM translation tables
• Internet check at install step only (offline-safe exit 0)
• Per-OEM four-leaf shape: *-configure.ps1 / *-command-update-install.ps1 / *-command-update-run.ps1 / *-debloat.ps1

Dropped: src/ directory, published branch, # %INCLUDE marker syntax, GHA fat-script workflow.

Files added

oem-dell/
├── dell-configure.ps1                  263 lines  (BIOS config from $env:BIOS_* env vars; inlined translation map)
├── dell-command-update-install.ps1     161 lines  (DCU install; internet-checked; inlined Test-InternetAvailable)
├── dell-command-update-run.ps1         146 lines  (DCU /scan + /applyUpdates; documented exit-code table)
└── dell-debloat.ps1                    186 lines  (uninstall SupportAssist + Dell consumer AppX; keeps Command tools)

Each script self-contains the helpers it needs:

• Test-DellHardware ... inlined into all four leaves.
• Test-DCUInstalled / Get-DCUVersion / Get-DCUCliPath ... inlined into dell-command-update-install.ps1 and dell-command-update-run.ps1.
• Test-InternetAvailable ... inlined into dell-command-update-install.ps1 only.
• $dellBiosSettingsMap translation table ... lives inside dell-configure.ps1 only.

Get-OEMManufacturer is intentionally not used in the Dell leaves ... they each know they're Dell scripts and use the simpler Test-DellHardware check. HP and Lenovo will follow the same pattern.

CLAUDE.md updates

New "OEM Vendor Scripts" section under Development Standards / Common Patterns. Covers:

• The four-leaf shape and what each leaf does
• Why configure, not baseline
• The $env:BIOS_* canonical settings table with per-OEM support matrix (Dell / HP / Lenovo)
• Internet check pattern (install leaves only)
• Self-contained guidance with the standard gate sequence

TODOs captured in code

• dell-command-update-install.ps1 ... canonical Dell-hosted DCU 5.7 installer URL. The placeholder https://dl.dell.com/FOLDER/Dell-Command-Update-Application_WIN_5.7.0_A00.EXE needs the real folder ID captured from a fresh manual download against https://www.dell.com/support/kbdoc/en-us/000177325/dell-command-update. The $env:DCUInstallerURL RMM variable overrides this, so the script ships functional even with the placeholder.
• dell-configure.ps1 ... map cctk exit codes to friendly messages once we have real-endpoint runs (e.g. 113 = password required).
• dell-command-update-run.ps1 ... capture any additional DCU exit codes observed in production beyond the documented 0-8 set.

No REPLACE_WITH_REAL_HASH placeholders ... they're gone for good. No runtime lib fetch.

Smoke tests

PowerShell parser check on each script:

OK:   oem-dell\dell-configure.ps1 (263 lines)
OK:   oem-dell\dell-command-update-install.ps1 (161 lines)
OK:   oem-dell\dell-command-update-run.ps1 (146 lines)
OK:   oem-dell\dell-debloat.ps1 (186 lines)

Executed each script in RMM mode on a non-Dell dev workstation (iBUYPOWER). All four hit the "Not a Dell endpoint. Skipping." gate cleanly, started/stopped transcripts to $env:RMMScriptPath\logs\, and exited 0. Confirms:

• Three-section template structure is intact.
• $TranscriptStarted guard pattern (PR Fix Stop-Transcript error when transcript not active #34) wraps Stop-Transcript calls properly.
• RMM mode routing to $env:RMMScriptPath\logs\ works.
• Manufacturer gate fires before any Dell-specific work.

Full Dell-endpoint testing (cctk invocation, DCU install/run, AppX removal) is pending against real Dell hardware. The TODOs above will be resolved as part of that pass.

References

• Closes the redo track started in design: OEM hybrid pattern redo (CI fat scripts, configure-not-baseline, RMM-driven options) #74 (design issue; includes the refinement comment that landed on self-contained scripts).
• Supersedes feature: CI fat-script build pipeline + new OEM pattern docs #75 (foundation, closed) and feature: Dell OEM configure (RMM-driven, internet-checked, no static policy) #76 (Dell src/ version, closed). Branch feature/oem-dell-redo retained on origin/ for cherry-pick reference.
• HP + Lenovo will follow as separate PRs once Dell is endpoint-validated, replicating this shape.

Test plan

• Real Dell endpoint, RMM mode: dell-configure.ps1 with $env:BIOS_TPMEnabled=Enabled + correct $env:BIOS_AdminPassword. Verify cctk exit 0 and BIOS reflects the change.
• Real Dell endpoint, no DCU installed: dell-command-update-install.ps1 with valid $env:DCUInstallerURL. Verify install completes and Get-DCUVersion reports the target.
• Real Dell endpoint, DCU installed: dell-command-update-run.ps1. Verify /scan then /applyUpdates runs and exits with a documented code.
• Real Dell endpoint with consumer SKU bloat: dell-debloat.ps1. Verify SupportAssist + AppX removals; verify Dell Command Update and Dell Command Configure are kept.
• Offline endpoint: dell-command-update-install.ps1. Verify clean exit 0 with offline-skip log line.

[claude]

⚠️ Code review skipped — your organization's overage spend limit has been reached.

Code review is billed via overage credits. To resume reviews, an organization admin can raise the monthly limit at claude.ai/admin-settings/claude-code.

Once credits are available, push a new commit or reopen this pull request to trigger a review.