fix(deploy-win): don't re-patch an already-patched ISO

deploy-win patched its input into vm_dir/install-noprompt.iso and only its
own sidecar cache could skip the repack — so feeding an already-patched ISO
(e.g. from `template patch-win-iso`, or via --win-iso) triggered a wasteful
second extract+repack that double-injected the answer files.

deploy-win now detects a patched input (autounattend.xml present at the ISO
root via `iso_patch.iso_has_root_file`) and uses it as-is, skipping Step 4.
Raw ISOs are still patched once and cached as before.

tests/python/test_winimage.py

@@ -127,6 +127,20 @@ def test_patch_iso_happy(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> Non
     assert result == out and out.is_file()
 
 
+def test_iso_has_root_file(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    monkeypatch.setattr(ip, "_require_7z", lambda: "7z")
+    iso = tmp_path / "x.iso"
+    iso.write_bytes(b"x")
+
+    def fake_run(argv: list[str], **_k: Any) -> subprocess.CompletedProcess[str]:
+        out = "2026 .... 6813 autounattend.xml\n" if "-i!autounattend.xml" in argv else ""
+        return subprocess.CompletedProcess(argv, 0, out, "")
+
+    monkeypatch.setattr(ip.subprocess, "run", fake_run)
+    assert ip.iso_has_root_file(iso, "autounattend.xml") is True
+    assert ip.iso_has_root_file(iso, "missing.xml") is False
+
+
 def test_patch_iso_missing_efi_boot(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
     base = tmp_path / "base.iso"
     base.write_bytes(b"x" * 1000)