fix(deploy-win): don't re-patch an already-patched ISO

deploy-win patched its input into vm_dir/install-noprompt.iso and only its
own sidecar cache could skip the repack — so feeding an already-patched ISO
(e.g. from `template patch-win-iso`, or via --win-iso) triggered a wasteful
second extract+repack that double-injected the answer files.

deploy-win now detects a patched input (autounattend.xml present at the ISO
root via `iso_patch.iso_has_root_file`) and uses it as-is, skipping Step 4.
Raw ISOs are still patched once and cached as before.

src/ci_orchestrator/winimage/iso_patch.py

@@ -38,6 +38,18 @@ def _require_7z() -> str:
     raise click.ClickException("7z not found. Install p7zip-full.")
 
 
+def iso_has_root_file(iso: Path, name: str) -> bool:
+    """True if ``name`` exists at the root of ``iso`` (used to detect a patched ISO)."""
+    sevenz = _require_7z()
+    proc = subprocess.run(
+        [sevenz, "l", str(iso), f"-i!{name}"],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    return proc.returncode == 0 and name.lower() in proc.stdout.lower()
+
+
 def _read_volid(base_iso: Path) -> str:
     """Read the ISO volume id (label); fall back to a sane default."""
     label = ""