fix(prepare-win): enforce cmd.exe shell during provisioning too

Setting Winlogon\Shell=cmd.exe only in the install-time post-install meant
existing templates (deployed earlier, or reverted to a pre-cmd snapshot)
kept explorer as the shell — re-running prepare-win never changed it, since
prepare runs the toolchain, not post-install. Set Shell=cmd.exe in the
prepare-win autologin re-affirm (before the final reboot) so any template
adopts it on the next prepare.

src/ci_orchestrator/commands/template.py

@@ -839,13 +839,18 @@ Register-ScheduledTask -TaskName 'CI-StaticIp' `
                 raise click.ClickException(f"Disk cleanup failed (exit {cleanup_ec}).")
             click.echo("[prepare-win] Post-update cleanup complete.")
 
-        # Re-affirm autologin (registry persists across the reboot below).
-        click.echo("[prepare-win] Re-affirming autologin registry settings ...")
+        # Re-affirm autologin + enforce the cmd.exe shell (registry persists
+        # across the reboot below). Setting Shell here — not only in the
+        # install-time post-install — means existing templates pick it up on the
+        # next prepare-win. A headless CI VM never needs explorer, and a running
+        # explorer crash-loops during heavy servicing; cmd removes that surface.
+        click.echo("[prepare-win] Re-affirming autologin + shell=cmd.exe ...")
         transport.run(
             "$wl = 'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon'\n"
             "Set-ItemProperty $wl AutoAdminLogon '1' -Type String -Force\n"
             f"Set-ItemProperty $wl DefaultUserName '{e(admin_username)}' -Type String -Force\n"
             "Set-ItemProperty $wl DefaultDomainName '.' -Type String -Force\n"
+            "Set-ItemProperty $wl Shell 'cmd.exe' -Type String -Force\n"
             f"if ('{e(admin_password)}' -ne '') {{\n"
             f"    Set-ItemProperty $wl DefaultPassword '{e(admin_password)}' -Type String -Force\n"
             "}\n"