The ISO repack (extract + xorriso, ~minutes) ran on every deploy. Cache it per VM dir: store an inputs key (base ISO size+mtime + rendered autounattend.xml + post-install.ps1) in a `.iso.inputs` sidecar next to install-noprompt.iso. Step 4 skips the repack when the patched ISO and a matching sidecar already exist, and re-patches automatically when the base ISO or either answer file changes.