feat(template): check-win-iso (massgrave resolver) + patch-win-iso

Add `ci template check-win-iso`: parse the massgrave windows-server-links
markdown source on GitHub for the newest Windows Server 2025 build, file
name and link, and report whether it is already in <CI_ROOT>/iso/. The
download itself stays manual — the massgrave link is behind a Cloudflare
Turnstile file host, not scriptable.

Add `ci template patch-win-iso --in ISO [--out ISO]`: standalone equivalent
of deploy-win Step 4 — inject autounattend.xml + post-install.ps1 and a
no-prompt boot image into a manually downloaded ISO, producing a
ready-to-deploy `.patched.iso`.

winimage/massgrave.py does the parse (no auto-download). RUNBOOK §5
documents the check → download → patch → deploy workflow. Coverage 93.6%.

docs/RUNBOOK-PhaseC.md

@@ -77,6 +77,8 @@ sudo); `--uninstall` removes the block. The script defines two helpers:
 | `ci vmware --vmx ...`         | Open a VMX in the VMware Workstation GUI             | [§4](#4-manual-vm-lifecycle)                        |
 | `ci creds set --user ...`     | Store guest credentials in the keyring               | [§5](#5-credentials--template-provisioning)         |
 | `ci template deploy-linux`    | Build the Linux template VM                          | [§5](#5-credentials--template-provisioning)         |
+| `ci template check-win-iso`   | Report the newest WS2025 ISO from massgrave + cache status | [§5](#5-credentials--template-provisioning) |
+| `ci template patch-win-iso`   | Inject autounattend + no-prompt boot into a Windows ISO | [§5](#5-credentials--template-provisioning) |
 | `ci template deploy-win`      | Build the Windows Server 2025 template VM (download→patch→deploy) | [§5](#5-credentials--template-provisioning)  |
 | `ci template prepare-linux`   | Provision the Linux template over SSH                | [§5](#5-credentials--template-provisioning)         |
 | `ci template prepare-win`     | Provision a Windows template over WinRM              | [§5](#5-credentials--template-provisioning)         |
@@ -432,6 +434,20 @@ ci template deploy-win --iso-url 'https://example/win2025.iso' --iso-sha256 <HAS
 ci template deploy-win --gui --win-iso /var/lib/ci/iso/win2025.iso   # local ISO, watch install
 ```
 
+**Finding / preparing an ISO from massgrave.** The massgrave "updated" link is
+behind a Cloudflare-Turnstile file host, so the download itself can't be
+scripted — but you can resolve the newest build and pre-patch a manual download:
+
+```bash
+ci template check-win-iso                       # newest WS2025 build + URL + cache status
+# → download that URL in a browser into /var/lib/ci/iso/<filename>, then:
+ci template patch-win-iso --in /var/lib/ci/iso/<filename>   # → <filename>.patched.iso
+ci template deploy-win --win-iso /var/lib/ci/iso/<filename>.patched.iso
+```
+
+(`deploy-win` patches the ISO itself too, so `patch-win-iso` is optional — use it
+to produce/inspect the bootable no-prompt ISO separately.)
+
 Notes:
 - Provide **exactly one** of `--iso-url` / `--win-iso`. A downloaded ISO is
   cached by its URL file name and reused on re-runs.