refactor(deploy-win): drop UUP dump, take ISO via --iso-url / --win-iso

On a Linux host the UUP converter only produces the RTM install.wim (build
26100.1), so Windows Update had to install the entire cumulative anyway —
the UUP download/convert machinery added a slow ~5 GB step and several host
tools (aria2/wimtools/cabextract/chntpw) for no benefit.

Replace it: deploy-win now takes the install ISO directly via `--iso-url`
(urllib download + cache by file name under <CI_ROOT>/iso/, optional
--iso-sha256) or a local `--win-iso` (exactly one required). Patch + deploy
flow is unchanged. Supply an already-updated ISO (e.g. a massgrave link) to
skip the WU step entirely.

- Remove winimage/uup.py and its tests.
- Trim setup-host-linux.sh deps to p7zip-full + xorriso + genisoimage.
- Update RUNBOOK §5 and the Windows-host port plan. Coverage 93.6%.

tests/python/test_commands_deploy_win.py

@@ -12,7 +12,6 @@ from click.testing import CliRunner
 
 import ci_orchestrator.commands.template as tmpl_mod
 from ci_orchestrator.__main__ import cli
-from ci_orchestrator.winimage import uup
 
 
 def _make_config(root: Path) -> types.SimpleNamespace:
@@ -195,25 +194,40 @@ def test_deploy_win_skips_patch_when_cached(
     assert "skipping repack" in result.output
 
 
-def test_deploy_win_uup_happy(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_deploy_win_iso_url_downloads(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
     root = tmp_path
     (root / "iso").mkdir(parents=True)
     (root / "iso" / "VMware-tools-windows.iso").write_bytes(b"tools")
-    _patch_deploy(monkeypatch, root)
-    monkeypatch.setattr(tmpl_mod.win_uup, "check_tools", lambda: [])
-    build = uup.UupBuild(uuid="u", build="26100.32860", title="t", arch="amd64")
-    monkeypatch.setattr(tmpl_mod.win_uup, "resolve_build", lambda **_k: build)
+    seen = _patch_deploy(monkeypatch, root)
 
-    def fake_build_iso(_b: uup.UupBuild, *, dest_dir: Path, **_k: Any) -> Path:
-        p = dest_dir / "ws2025-26100.32860.iso"
-        p.write_bytes(b"iso")
-        return p
+    downloaded: dict[str, str] = {}
 
-    monkeypatch.setattr(tmpl_mod.win_uup, "build_iso", fake_build_iso)
+    def fake_dl(url: str, dest: Path) -> None:
+        downloaded["url"] = url
+        dest.write_bytes(b"iso")
 
-    result = CliRunner().invoke(cli, ["template", "deploy-win", "--nogui"])
+    monkeypatch.setattr(tmpl_mod, "_download_vmdk", fake_dl)
+
+    result = CliRunner().invoke(
+        cli,
+        ["template", "deploy-win", "--nogui",
+         "--iso-url", "https://example.test/win2025.iso"],
+    )
     assert result.exit_code == 0, result.output
-    assert "26100.32860" in result.output
+    assert downloaded["url"].endswith("win2025.iso")
+    assert (root / "iso" / "win2025.iso").is_file()  # cached under <iso> by basename
+    assert seen["patched"]
+
+
+def test_deploy_win_requires_one_source(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    root = tmp_path
+    (root / "iso").mkdir(parents=True)
+    (root / "iso" / "VMware-tools-windows.iso").write_bytes(b"t")
+    _patch_deploy(monkeypatch, root)
+    # neither --iso-url nor --win-iso
+    result = CliRunner().invoke(cli, ["template", "deploy-win", "--nogui"])
+    assert result.exit_code != 0
+    assert "exactly one of --iso-url or --win-iso" in result.output
 
 
 def test_deploy_win_bad_computer_name(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None: