fix(deploy-win): don't re-patch an already-patched ISO

deploy-win patched its input into vm_dir/install-noprompt.iso and only its
own sidecar cache could skip the repack — so feeding an already-patched ISO
(e.g. from `template patch-win-iso`, or via --win-iso) triggered a wasteful
second extract+repack that double-injected the answer files.

deploy-win now detects a patched input (autounattend.xml present at the ISO
root via `iso_patch.iso_has_root_file`) and uses it as-is, skipping Step 4.
Raw ISOs are still patched once and cached as before.

tests/python/test_commands_deploy_win.py

@@ -194,6 +194,30 @@ def test_deploy_win_skips_patch_when_cached(
     assert "skipping repack" in result.output
 
 
+def test_deploy_win_uses_already_patched_iso(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    root = tmp_path
+    (root / "iso").mkdir(parents=True)
+    (root / "iso" / "VMware-tools-windows.iso").write_bytes(b"tools")
+    base = root / "iso" / "ws.patched.iso"
+    base.write_bytes(b"win")
+    _patch_deploy(monkeypatch, root)
+    # Pretend the input ISO already carries autounattend.xml at its root.
+    monkeypatch.setattr(tmpl_mod.win_iso_patch, "iso_has_root_file", lambda *_a: True)
+
+    def boom(*_a: Any, **_k: Any) -> Path:
+        raise AssertionError("patch_iso must not run for an already-patched ISO")
+
+    monkeypatch.setattr(tmpl_mod.win_iso_patch, "patch_iso", boom)
+
+    result = CliRunner().invoke(
+        cli, ["template", "deploy-win", "--win-iso", str(base), "--nogui"]
+    )
+    assert result.exit_code == 0, result.output
+    assert "already patched" in result.output  # and boom (patch_iso) was never raised
+
+
 def test_deploy_win_iso_url_downloads(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
     root = tmp_path
     (root / "iso").mkdir(parents=True)