refactor(deploy-win): drop UUP dump, take ISO via --iso-url / --win-iso

On a Linux host the UUP converter only produces the RTM install.wim (build
26100.1), so Windows Update had to install the entire cumulative anyway —
the UUP download/convert machinery added a slow ~5 GB step and several host
tools (aria2/wimtools/cabextract/chntpw) for no benefit.

Replace it: deploy-win now takes the install ISO directly via `--iso-url`
(urllib download + cache by file name under <CI_ROOT>/iso/, optional
--iso-sha256) or a local `--win-iso` (exactly one required). Patch + deploy
flow is unchanged. Supply an already-updated ISO (e.g. a massgrave link) to
skip the WU step entirely.

- Remove winimage/uup.py and its tests.
- Trim setup-host-linux.sh deps to p7zip-full + xorriso + genisoimage.
- Update RUNBOOK §5 and the Windows-host port plan. Coverage 93.6%.

docs/RUNBOOK-PhaseC.md

@@ -77,7 +77,7 @@ sudo); `--uninstall` removes the block. The script defines two helpers:
 | `ci vmware --vmx ...`         | Open a VMX in the VMware Workstation GUI             | [§4](#4-manual-vm-lifecycle)                        |
 | `ci creds set --user ...`     | Store guest credentials in the keyring               | [§5](#5-credentials--template-provisioning)         |
 | `ci template deploy-linux`    | Build the Linux template VM                          | [§5](#5-credentials--template-provisioning)         |
-| `ci template deploy-win`      | Build the Windows Server 2025 template VM (UUP→patch→deploy) | [§5](#5-credentials--template-provisioning)  |
+| `ci template deploy-win`      | Build the Windows Server 2025 template VM (download→patch→deploy) | [§5](#5-credentials--template-provisioning)  |
 | `ci template prepare-linux`   | Provision the Linux template over SSH                | [§5](#5-credentials--template-provisioning)         |
 | `ci template prepare-win`     | Provision a Windows template over WinRM              | [§5](#5-credentials--template-provisioning)         |
 | `ci template backup`          | Timestamped copy of the template directories         | [§5](#5-credentials--template-provisioning)         |
@@ -418,26 +418,29 @@ ci template backup               # timestamped backup of the template directorie
 
 ### `deploy-win` — build the Windows Server 2025 template
 
-Downloads the newest WS2025 ISO from **UUP dump** (deterministic, build-pinned;
-component files are MS-signed), patches it (injects `autounattend.xml` +
-`post-install.ps1` and swaps the EFI boot image to the no-prompt variant), then
-runs the unattended install, swaps the NIC e1000e → vmxnet3 and takes the cold
-`PostInstall` snapshot. VMware Tools are mounted as a second CD.
+Takes a Windows Server 2025 install ISO — downloaded from `--iso-url` (cached
+under `/var/lib/ci/iso/` by file name) or a local `--win-iso` — patches it
+(injects `autounattend.xml` + `post-install.ps1` and swaps the EFI boot image to
+the no-prompt variant), runs the unattended install, swaps the NIC e1000e →
+vmxnet3 and takes the cold `PostInstall` snapshot. VMware Tools are mounted as a
+second CD.
 
 ```bash
-ci template deploy-win                              # newest build, headless
-ci template deploy-win --gui                        # watch the install (needs X — §4.7)
-ci template deploy-win --build 26100.32860          # pin a specific build (reproducible)
-ci template deploy-win --win-iso /var/lib/ci/iso/my.iso   # skip UUP, use a local ISO
+# Download + deploy (e.g. a massgrave direct link), headless
+ci template deploy-win --iso-url 'https://example/win2025.iso'
+ci template deploy-win --iso-url 'https://example/win2025.iso' --iso-sha256 <HASH>   # verify
+ci template deploy-win --gui --win-iso /var/lib/ci/iso/win2025.iso   # local ISO, watch install
 ```
 
 Notes:
-- First run downloads ~5 GB and builds the ISO locally (slow, tens of minutes);
-  the result is cached at `/var/lib/ci/iso/ws2025-<build>.iso` and reused.
-- Needs `aria2`, `wimtools`, `xorriso`, `genisoimage`, `cabextract`, `chntpw`
-  (installed by `setup-host-linux.sh`) and ~16 GiB scratch for the ISO repack.
-- The final ISO hash is not canonical (assembled locally); the UUP component
-  files are MS-signed. Pin `--build` for reproducible inputs.
+- Provide **exactly one** of `--iso-url` / `--win-iso`. A downloaded ISO is
+  cached by its URL file name and reused on re-runs.
+- The supplied ISO is the install media you give it — e.g. an updated WS2025 ISO
+  from massgrave. (UUP dump was dropped: on Linux it only yields the RTM
+  `install.wim`, so Windows Update had to install the whole cumulative anyway.)
+- Needs `p7zip-full`, `xorriso` (installed by `setup-host-linux.sh`) and ~16 GiB
+  scratch for the ISO repack. The patched ISO is cached per VM dir and only
+  rebuilt when the base ISO or answer files change.
 - After it finishes: `ci template prepare-win` then
   `ci validate guest --winrm --guest-os windows`.