fix(deploy-win): sanitise ISO volume id to silence xorriso warning

The base ISO's volume label (e.g. "26100.1_X64_EN-US") contains characters
outside strict ISO 9660 d-characters, so xorriso warned "-volid text does
not comply to ISO 9660 / ECMA 119 rules" on every repack. Map the label to
[A-Z0-9_] (cap 16). Cosmetic only — Windows boots from the El Torito images,
not the volid — but keeps the output clean.

src/ci_orchestrator/winimage/iso_patch.py

@@ -12,6 +12,7 @@ EFI El Torito boot image (the no-prompt variant Microsoft ships on the ISO).
 
 from __future__ import annotations
 
+import re
 import shutil
 import subprocess
 from pathlib import Path
@@ -62,8 +63,11 @@ def _read_volid(base_iso: Path) -> str:
             check=False,
         )
         label = proc.stdout.strip()
-    # Joliet volume ids are capped at 16 chars; longer ids make xorriso warn.
-    return (label or "WINSERVER")[:16]
+    # Sanitise to strict ISO 9660 d-characters (A-Z 0-9 _) and cap at 16 (Joliet
+    # limit) so xorriso doesn't warn about a non-compliant volume id. The label
+    # is cosmetic — Windows boots from the El Torito images, not the volid.
+    clean = re.sub(r"[^A-Z0-9_]", "_", (label or "WINSERVER").upper())
+    return clean[:16] or "WINSERVER"
 
 
 def _check_free_space(base_iso: Path, work_parent: Path) -> None: