install: stage pxe-setup.sh at /usr/local/sbin/vetting-pxe-setup

proxmox-install.sh tarball-extracts into a tempdir that gets wiped on
EXIT, so after the one-liner there's no pxe-setup.sh on disk for the
operator to run. Have install.sh drop the script + ipxe-shas.txt into
/usr/local/share/vetting/ and symlink it as
/usr/local/sbin/vetting-pxe-setup (in PATH).

pxe-setup.sh now readlink -f's BASH_SOURCE so the symlink resolves to
the share dir where ipxe-shas.txt lives, and gracefully handles the
case where install.sh already staged vmlinuz + initrd.img into
LIVE_DIR (no bundle live-image/ needed at that point).

Update the trailing hint in proxmox-install.sh and the operations
runbook to surface the new `sudo vetting-pxe-setup ...` command.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

deploy/pxe-setup.sh

@@ -38,7 +38,10 @@ BUNDLE_DIR=""
 FORCE=0
 SERVICE_USER="vetting"
 
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# Resolve symlinks so `vetting-pxe-setup` (a symlink into /usr/local/sbin
+# installed by install.sh) finds ipxe-shas.txt alongside the real script
+# in /usr/local/share/vetting/.
+SCRIPT_DIR="$(cd "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")" && pwd)"
 
 usage() {
     sed -n '2,28p' "${BASH_SOURCE[0]}"
@@ -176,10 +179,17 @@ for cand in \
 done
 
 if [[ -z "${LIVE_SRC}" ]]; then
-    echo "WARN: no live image found under ${BUNDLE_DIR}/live-image or" >&2
-    echo "      ${BUNDLE_DIR}/../live-image/build — skipping live_dir staging." >&2
-    echo "      Build with 'wsl make live-image' or use a release tarball," >&2
-    echo "      then copy vmlinuz + initrd.img into ${LIVE_DIR} manually." >&2
+    # install.sh already stages vmlinuz + initrd.img into LIVE_DIR during
+    # the one-liner install, so a missing bundle/live-image/ is expected
+    # when pxe-setup.sh is run from /usr/local/sbin.
+    if [[ -f "${LIVE_DIR}/vmlinuz" && -f "${LIVE_DIR}/initrd.img" ]]; then
+        echo "==> live image already staged in ${LIVE_DIR} (from install.sh)"
+    else
+        echo "WARN: no live image found under ${BUNDLE_DIR}/live-image," >&2
+        echo "      ${BUNDLE_DIR}/../live-image/build, or ${LIVE_DIR}." >&2
+        echo "      The orchestrator will fail PXE startup validation until" >&2
+        echo "      vmlinuz + initrd.img land in ${LIVE_DIR}." >&2
+    fi
 else
     echo "==> staging live image from ${LIVE_SRC} into ${LIVE_DIR}"
     install -d -m 0755 -o "${SERVICE_USER}" -g "${SERVICE_USER}" "${LIVE_DIR}"