docs: document deploy-win + Windows-host port plan

RUNBOOK §1/§5 gain `ci template deploy-win` (UUP determinism, build pin,
--win-iso, tooling + scratch-space notes). Add plans/deploy-win-windows-host.md
describing the deferred cross-platform port (os.name dispatch to oscdimg /
IMAPI2FS shim; deploy-linux seed ISO via oscdimg on Windows).

docs/RUNBOOK-PhaseC.md

@@ -77,6 +77,7 @@ sudo); `--uninstall` removes the block. The script defines two helpers:
 | `ci vmware --vmx ...`         | Open a VMX in the VMware Workstation GUI             | [§4](#4-manual-vm-lifecycle)                        |
 | `ci creds set --user ...`     | Store guest credentials in the keyring               | [§5](#5-credentials--template-provisioning)         |
 | `ci template deploy-linux`    | Build the Linux template VM                          | [§5](#5-credentials--template-provisioning)         |
+| `ci template deploy-win`      | Build the Windows Server 2025 template VM (UUP→patch→deploy) | [§5](#5-credentials--template-provisioning)  |
 | `ci template prepare-linux`   | Provision the Linux template over SSH                | [§5](#5-credentials--template-provisioning)         |
 | `ci template prepare-win`     | Provision a Windows template over WinRM              | [§5](#5-credentials--template-provisioning)         |
 | `ci template backup`          | Timestamped copy of the template directories         | [§5](#5-credentials--template-provisioning)         |
@@ -409,11 +410,37 @@ Run `ci template <sub> --help` for the (many) per-template options.
 
 ```bash
 ci template deploy-linux         # build the Linux template VM from scratch (Ubuntu 24.04)
+ci template deploy-win           # build the Windows Server 2025 template VM (see below)
 ci template prepare-linux        # provision an existing Linux template over SSH
 ci template prepare-win          # provision a Windows template over WinRM (Linux-host driven)
 ci template backup               # timestamped backup of the template directories
 ```
 
+### `deploy-win` — build the Windows Server 2025 template
+
+Downloads the newest WS2025 ISO from **UUP dump** (deterministic, build-pinned;
+component files are MS-signed), patches it (injects `autounattend.xml` +
+`post-install.ps1` and swaps the EFI boot image to the no-prompt variant), then
+runs the unattended install, swaps the NIC e1000e → vmxnet3 and takes the cold
+`PostInstall` snapshot. VMware Tools are mounted as a second CD.
+
+```bash
+ci template deploy-win                              # newest build, headless
+ci template deploy-win --gui                        # watch the install (needs X — §4.7)
+ci template deploy-win --build 26100.32860          # pin a specific build (reproducible)
+ci template deploy-win --win-iso /var/lib/ci/iso/my.iso   # skip UUP, use a local ISO
+```
+
+Notes:
+- First run downloads ~5 GB and builds the ISO locally (slow, tens of minutes);
+  the result is cached at `/var/lib/ci/iso/ws2025-<build>.iso` and reused.
+- Needs `aria2`, `wimtools`, `xorriso`, `genisoimage`, `cabextract`, `chntpw`
+  (installed by `setup-host-linux.sh`) and ~16 GiB scratch for the ISO repack.
+- The final ISO hash is not canonical (assembled locally); the UUP component
+  files are MS-signed. Pin `--build` for reproducible inputs.
+- After it finishes: `ci template prepare-win` then
+  `ci validate guest --winrm --guest-os windows`.
+
 ---
 
 ## 6. Maintenance