fix(deploy-win): don't re-patch an already-patched ISO

deploy-win patched its input into vm_dir/install-noprompt.iso and only its
own sidecar cache could skip the repack — so feeding an already-patched ISO
(e.g. from `template patch-win-iso`, or via --win-iso) triggered a wasteful
second extract+repack that double-injected the answer files.

deploy-win now detects a patched input (autounattend.xml present at the ISO
root via `iso_patch.iso_has_root_file`) and uses it as-is, skipping Step 4.
Raw ISOs are still patched once and cached as before.

tests/python/test_commands_deploy_win.py

@@ -194,6 +194,30 @@ def test_deploy_win_skips_patch_when_cached(
     assert "skipping repack" in result.output
 
 
+def test_deploy_win_uses_already_patched_iso(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    root = tmp_path
+    (root / "iso").mkdir(parents=True)
+    (root / "iso" / "VMware-tools-windows.iso").write_bytes(b"tools")
+    base = root / "iso" / "ws.patched.iso"
+    base.write_bytes(b"win")
+    _patch_deploy(monkeypatch, root)
+    # Pretend the input ISO already carries autounattend.xml at its root.
+    monkeypatch.setattr(tmpl_mod.win_iso_patch, "iso_has_root_file", lambda *_a: True)
+
+    def boom(*_a: Any, **_k: Any) -> Path:
+        raise AssertionError("patch_iso must not run for an already-patched ISO")
+
+    monkeypatch.setattr(tmpl_mod.win_iso_patch, "patch_iso", boom)
+
+    result = CliRunner().invoke(
+        cli, ["template", "deploy-win", "--win-iso", str(base), "--nogui"]
+    )
+    assert result.exit_code == 0, result.output
+    assert "already patched" in result.output  # and boom (patch_iso) was never raised
+
+
 def test_deploy_win_iso_url_downloads(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
     root = tmp_path
     (root / "iso").mkdir(parents=True)

tests/python/test_winimage.py

@@ -127,6 +127,20 @@ def test_patch_iso_happy(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> Non
     assert result == out and out.is_file()
 
 
+def test_iso_has_root_file(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    monkeypatch.setattr(ip, "_require_7z", lambda: "7z")
+    iso = tmp_path / "x.iso"
+    iso.write_bytes(b"x")
+
+    def fake_run(argv: list[str], **_k: Any) -> subprocess.CompletedProcess[str]:
+        out = "2026 .... 6813 autounattend.xml\n" if "-i!autounattend.xml" in argv else ""
+        return subprocess.CompletedProcess(argv, 0, out, "")
+
+    monkeypatch.setattr(ip.subprocess, "run", fake_run)
+    assert ip.iso_has_root_file(iso, "autounattend.xml") is True
+    assert ip.iso_has_root_file(iso, "missing.xml") is False
+
+
 def test_patch_iso_missing_efi_boot(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
     base = tmp_path / "base.iso"
     base.write_bytes(b"x" * 1000)