fix(deploy-win): post-install picks VMware Tools CD, not the install ISO

The patched install ISO is mounted as a CD and has setup.exe at its root
(Windows Server Setup). The first-logon CD scan matched it before the
VMware Tools CD and ran `setup.exe /s /v...`, which Windows Setup rejects
("unknown command-line option [/s]"), and copied the multi-GB install
media instead of the Tools payload.

Skip any CD that carries sources\install.wim / install.esd (the OS
installer) and prefer setup64.exe (VMware Tools x64 has it; Windows media
does not) when resolving the Tools setup.

src/ci_orchestrator/winimage/assets/post-install.win.ps1.tmpl

@@ -27,8 +27,19 @@ foreach ($name in 'setup64.exe','setup.exe') {
 if (-not $toolsExe) {
     L 'Bundled Tools not found, scanning CD drives...'
     foreach ($drv in (Get-CimInstance Win32_LogicalDisk -Filter 'DriveType=5')) {
+        $root = $drv.DeviceID + '\'
+        # Skip the Windows install media — it also has setup.exe at its root, but
+        # that is the OS installer, not VMware Tools (running it with /s /v gives
+        # "unknown command-line option [/s]"). The install ISO is identified by
+        # sources\install.wim / install.esd; the VMware Tools CD has neither.
+        if ((Test-Path (Join-Path $root 'sources\install.wim')) -or
+            (Test-Path (Join-Path $root 'sources\install.esd'))) {
+            L "  skipping Windows install media: $root"
+            continue
+        }
+        # VMware Tools x64 ships setup64.exe (Windows media does not); prefer it.
         foreach ($name in 'setup64.exe','setup.exe') {
-            $cand = Join-Path ($drv.DeviceID + '\') $name
+            $cand = Join-Path $root $name
             if (Test-Path $cand) { $toolsExe = $cand; break }
         }
         if ($toolsExe) { break }