fix(template): §7.4 e2e fixes + autologin + validation scripts

Fix emerged during §7.4 e2e test run (2026-05-10):
- Deploy: set UsoSvc to Manual explicitly (Server 2025 default = Automatic)
- Setup cleanup: re-apply Set-Service Disabled on wuauserv/UsoSvc after DISM
  StartComponentCleanup (WaaSMedicSvc resets StartType during component store cleanup)
- Deploy + Setup: add Administrator autologin (AutoAdminLogon, DefaultUserName,
  DefaultPassword, DefaultDomainName) in post-install.ps1; Assert-Step 5c validates it
- Add Validate-DeployState.ps1: standalone host-side check of all Deploy-set state
- Add Validate-SetupState.ps1: standalone host-side check of full post-Setup state
- Mark §7.4, §7.1 and §7.2 e2e validation items as complete in TODO.md
- Update docs: WINDOWS-TEMPLATE-SETUP.md (arch table, validation scripts section,
  autologin in confine Deploy/Setup); TEST-7.4-e2e.md checklist marked done

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

template/Prepare-WinBuild2025.ps1

@@ -437,7 +437,17 @@ try {
         Write-Host "[Prepare] Output from guest:"
         Write-Host "------------------------------------------------------------"
 
-        $result = Invoke-GuestSetup -Session $session -ScriptPath $guestScriptPath -ScriptArgs $setupArgs
+        $result = $null
+        try {
+            $result = Invoke-GuestSetup -Session $session -ScriptPath $guestScriptPath -ScriptArgs $setupArgs
+        } catch [System.Management.Automation.Remoting.PSRemotingTransportException] {
+            # VM rebooted mid-update (WU triggered OS restart before Setup could return 3010).
+            # Treat as reboot-required: close dead session, fall through to the reboot-wait block.
+            Write-Host "[Prepare] WinRM transport error — VM rebooted mid-update. Treating as reboot-required..."
+            Remove-PSSession $session -ErrorAction SilentlyContinue
+            $session = $null
+            $result  = 3010
+        }
 
         Write-Host "------------------------------------------------------------"
         Write-Host "[Prepare] Iteration $iter exit code: $result"
@@ -448,18 +458,19 @@ try {
             throw "Setup-WinBuild2025.ps1 exited with code $result"
         }
 
-        # exit 3010 → WU applied updates needing reboot. Reboot guest, wait,
-        # reopen session, loop. -SkipWindowsUpdate must NOT be set on retry —
-        # we want the next iteration to drain remaining updates.
+        # exit 3010 (or transport error treated as 3010) → WU needs reboot.
+        # Reboot guest if session still alive, wait for WinRM, reopen session, loop.
         if ($iter -eq $maxWuIterations) {
             throw "Windows Update did not converge after $maxWuIterations iterations (still returning 3010)"
         }
 
         Write-Host "[Prepare] WU applied patches → reboot required. Rebooting guest..."
-        try {
-            Invoke-Command -Session $session -ScriptBlock { Restart-Computer -Force } -ErrorAction SilentlyContinue
-        } catch { }
-        Remove-PSSession $session -ErrorAction SilentlyContinue
+        if ($session) {
+            try {
+                Invoke-Command -Session $session -ScriptBlock { Restart-Computer -Force } -ErrorAction SilentlyContinue
+            } catch { }
+            Remove-PSSession $session -ErrorAction SilentlyContinue
+        }
 
         Start-Sleep -Seconds 30  # let WinRM tear down before polling
         Write-Host "[Prepare] Waiting for guest WinRM to come back (max $rebootDeadlineMin min)..."