install: stage pxe-setup.sh at /usr/local/sbin/vetting-pxe-setup

proxmox-install.sh tarball-extracts into a tempdir that gets wiped on
EXIT, so after the one-liner there's no pxe-setup.sh on disk for the
operator to run. Have install.sh drop the script + ipxe-shas.txt into
/usr/local/share/vetting/ and symlink it as
/usr/local/sbin/vetting-pxe-setup (in PATH).

pxe-setup.sh now readlink -f's BASH_SOURCE so the symlink resolves to
the share dir where ipxe-shas.txt lives, and gracefully handles the
case where install.sh already staged vmlinuz + initrd.img into
LIVE_DIR (no bundle live-image/ needed at that point).

Update the trailing hint in proxmox-install.sh and the operations
runbook to surface the new `sudo vetting-pxe-setup ...` command.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

deploy/install.sh

@@ -144,6 +144,18 @@ else
 fi
 install -m 0644 "${SCRIPT_DIR}/vetting.service" /etc/systemd/system/vetting.service
 
+# Install pxe-setup.sh + its pinned iPXE SHAs into a stable path so the
+# operator can run `vetting-pxe-setup ...` after the one-liner install.
+# The bundle's tempdir gets wiped by proxmox-install.sh on exit, so
+# without this the script would be inaccessible.
+if [[ -f "${SCRIPT_DIR}/pxe-setup.sh" && -f "${SCRIPT_DIR}/ipxe-shas.txt" ]]; then
+    echo "==> installing pxe-setup.sh and ipxe-shas.txt"
+    install -d -m 0755 /usr/local/share/vetting
+    install -m 0755 "${SCRIPT_DIR}/pxe-setup.sh"    /usr/local/share/vetting/pxe-setup.sh
+    install -m 0644 "${SCRIPT_DIR}/ipxe-shas.txt"   /usr/local/share/vetting/ipxe-shas.txt
+    ln -sfn /usr/local/share/vetting/pxe-setup.sh /usr/local/sbin/vetting-pxe-setup
+fi
+
 # Stage the live image into LIVE_DIR if we can find one. Two layouts:
 #   - release bundle:    ${SCRIPT_DIR}/live-image/{vmlinuz,initrd.img}
 #   - repo-tree dev run: ${REPO_ROOT}/live-image/build/{vmlinuz,initrd.img}