feat(deploy-win): cache the patched ISO, skip repack when inputs unchanged

The ISO repack (extract + xorriso, ~minutes) ran on every deploy. Cache it
per VM dir: store an inputs key (base ISO size+mtime + rendered
autounattend.xml + post-install.ps1) in a `.iso.inputs` sidecar next to
install-noprompt.iso. Step 4 skips the repack when the patched ISO and a
matching sidecar already exist, and re-patches automatically when the base
ISO or either answer file changes.

tests/python/test_commands_deploy_win.py

@@ -151,6 +151,50 @@ def test_deploy_win_winiso_happy(tmp_path: Path, monkeypatch: pytest.MonkeyPatch
     assert 'ethernet0.virtualDev = "vmxnet3"' in text
 
 
+def test_patched_iso_inputs_key_stable(tmp_path: Path) -> None:
+    iso = tmp_path / "b.iso"
+    iso.write_bytes(b"x" * 10)
+    k1 = tmpl_mod._patched_iso_inputs_key(iso, "<x/>", "ps")
+    k2 = tmpl_mod._patched_iso_inputs_key(iso, "<x/>", "ps")
+    k3 = tmpl_mod._patched_iso_inputs_key(iso, "<y/>", "ps")
+    assert k1 == k2 and k1 != k3
+
+
+def test_deploy_win_skips_patch_when_cached(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    from ci_orchestrator.winimage import autounattend as au
+
+    root = tmp_path
+    (root / "iso").mkdir(parents=True)
+    (root / "iso" / "VMware-tools-windows.iso").write_bytes(b"tools")
+    base = root / "iso" / "ws.iso"
+    base.write_bytes(b"win")
+    _patch_deploy(monkeypatch, root)
+
+    # Pre-create the patched ISO + a matching inputs sidecar.
+    vm_dir = root / "templates" / "WinBuild2025"
+    vm_dir.mkdir(parents=True)
+    patched = vm_dir / "install-noprompt.iso"
+    patched.write_bytes(b"iso")
+    params = au.WinUnattendParams()
+    key = tmpl_mod._patched_iso_inputs_key(
+        base, au.render_autounattend(params), au.render_post_install(params)
+    )
+    (vm_dir / "install-noprompt.iso.inputs").write_text(key, encoding="utf-8")
+
+    def boom(*_a: Any, **_k: Any) -> Path:
+        raise AssertionError("patch_iso should not run when cache is valid")
+
+    monkeypatch.setattr(tmpl_mod.win_iso_patch, "patch_iso", boom)
+
+    result = CliRunner().invoke(
+        cli, ["template", "deploy-win", "--win-iso", str(base), "--nogui", "--force"]
+    )
+    assert result.exit_code == 0, result.output
+    assert "skipping repack" in result.output
+
+
 def test_deploy_win_uup_happy(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
     root = tmp_path
     (root / "iso").mkdir(parents=True)