refactor(deploy-win): drop UUP dump, take ISO via --iso-url / --win-iso

On a Linux host the UUP converter only produces the RTM install.wim (build
26100.1), so Windows Update had to install the entire cumulative anyway —
the UUP download/convert machinery added a slow ~5 GB step and several host
tools (aria2/wimtools/cabextract/chntpw) for no benefit.

Replace it: deploy-win now takes the install ISO directly via `--iso-url`
(urllib download + cache by file name under <CI_ROOT>/iso/, optional
--iso-sha256) or a local `--win-iso` (exactly one required). Patch + deploy
flow is unchanged. Supply an already-updated ISO (e.g. a massgrave link) to
skip the WU step entirely.

- Remove winimage/uup.py and its tests.
- Trim setup-host-linux.sh deps to p7zip-full + xorriso + genisoimage.
- Update RUNBOOK §5 and the Windows-host port plan. Coverage 93.6%.

plans/deploy-win-windows-host.md

@@ -12,17 +12,15 @@ duplicating the orchestration logic.
 The Python orchestrator stays the single entry point. Where a step needs a
 Windows-only tool, Python detects `os.name == "nt"` and routes that one step to
 a thin PowerShell shim (or reuses functions already in
-`template/Deploy-WinBuild2025.ps1`). Everything else (UUP resolve/download, VMX
+`template/Deploy-WinBuild2025.ps1`). Everything else (ISO download/cache, VMX
 build, vmrun lifecycle, flag wait, NIC swap, snapshot) is already
 platform-neutral Python and is reused unchanged.
 
 ## What already works cross-platform (reuse as-is)
 
-- `winimage/uup.py` — pure `urllib`/`subprocess`/`zipfile`. The **conversion
-  package** must run the Windows variant: invoke `uup_download_windows.cmd`
-  (present in the same zip) instead of `uup_download_linux.sh`. Add an
-  `os.name`-based branch in `build_iso` to pick the script; the Windows `.cmd`
-  needs `aria2c.exe` + the bundled converter (it self-fetches via `get_aria2.ps1`).
+- ISO acquisition: `deploy-win --iso-url` (urllib download + cache) / `--win-iso`
+  is pure stdlib and portable as-is. (UUP dump was removed — on Linux it only
+  produced the RTM `install.wim`; supply an updated ISO directly instead.)
 - `winimage/autounattend.py` — `importlib.resources`, fully portable.
 - `commands/template.py` deploy-win orchestration: `_winbuild_vmx_lines`,
   `_remove_vmx_lines`, `_patch_vmx_key`, `_wait_install_flag`,
@@ -69,10 +67,10 @@ portable.
    `isotool`. Keep current Linux behaviour byte-for-byte.
 3. `template/shims/patch-win-iso.ps1` (new, lint-clean PS 5.1) — oscdimg wrapper;
    optional IMAPI2FS fallback reusing `Deploy-WinBuild2025.ps1` functions.
-4. `uup.build_iso` — pick `uup_download_windows.cmd` on Windows.
-5. Preflight: on Windows check for `oscdimg.exe` (ADK) / `aria2c.exe` instead of
-   the Linux tools; clear error if the ADK is missing.
-6. Tests: parametrize the new `isotool` dispatch (mock `os.name`); mock the shim
+4. Preflight: on Windows check for `oscdimg.exe` (ADK) / `7z` instead of the
+   Linux tools; clear error if the ADK is missing. (ISO download is stdlib —
+   no extra tool.)
+5. Tests: parametrize the new `isotool` dispatch (mock `os.name`); mock the shim
    call. Keep coverage ≥90%.
 7. Docs: note Windows-host prerequisites (Windows ADK for `oscdimg`) in
    `docs/RUNBOOK-PhaseC.md` / a Windows runbook.
@@ -88,5 +86,3 @@ portable.
 
 - `oscdimg` boot-args syntax differs from xorriso; validate the no-prompt UEFI
   boot on a real VM.
-- The Windows UUP `.cmd` converter pulls its own toolchain; ensure it runs
-  non-interactively (it can prompt — pass the right flags / answer file).