fix(template): §7.4 e2e fixes + autologin + validation scripts

Fix emerged during §7.4 e2e test run (2026-05-10):
- Deploy: set UsoSvc to Manual explicitly (Server 2025 default = Automatic)
- Setup cleanup: re-apply Set-Service Disabled on wuauserv/UsoSvc after DISM
  StartComponentCleanup (WaaSMedicSvc resets StartType during component store cleanup)
- Deploy + Setup: add Administrator autologin (AutoAdminLogon, DefaultUserName,
  DefaultPassword, DefaultDomainName) in post-install.ps1; Assert-Step 5c validates it
- Add Validate-DeployState.ps1: standalone host-side check of all Deploy-set state
- Add Validate-SetupState.ps1: standalone host-side check of full post-Setup state
- Mark §7.4, §7.1 and §7.2 e2e validation items as complete in TODO.md
- Update docs: WINDOWS-TEMPLATE-SETUP.md (arch table, validation scripts section,
  autologin in confine Deploy/Setup); TEST-7.4-e2e.md checklist marked done

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

template/Setup-WinBuild2025.ps1

@@ -360,6 +360,10 @@ Assert-Step 'CIUX' 'OOBE policy DisablePrivacyExperience=1' {
 Assert-Step 'CIUX' 'DataCollection AllowTelemetry=0' {
     (Get-ItemProperty -Path $dcKey -Name AllowTelemetry -ErrorAction Stop).AllowTelemetry -eq 0
 }
+Assert-Step 'CIUX' 'autologin Administrator enabled (AutoAdminLogon=1)' {
+    $wl = Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' -ErrorAction Stop
+    $wl.AutoAdminLogon -eq '1' -and $wl.DefaultUserName -eq 'Administrator'
+}
 
 # ── Step 6: Windows Update ────────────────────────────────────────────────────
 # Firewall + Defender already off: WU downloads and installs run without scanning.
@@ -919,6 +923,12 @@ Write-Host "DISM exited (code $($dism.ExitCode))."
 
 Write-Host "Disk cleanup complete."
 
+# DISM StartComponentCleanup / WaaSMedicSvc may reset service StartType during cleanup.
+# Re-enforce Disabled on both WU services after DISM completes.
+foreach ($svc in 'wuauserv', 'UsoSvc') {
+    Set-Service -Name $svc -StartupType Disabled -ErrorAction SilentlyContinue
+}
+
 # Validation — leftover artifacts from this run should be gone
 # Note: do NOT assert SoftwareDistribution\Download empty.
 # WaaSMedicSvc (Windows Update Medic Service) is tamper-protected — cannot be stopped —
@@ -929,7 +939,7 @@ $sdFiles = Get-ChildItem 'C:\Windows\SoftwareDistribution\Download' -Recurse -Fi
 $sdMB    = [math]::Round(($sdFiles | Measure-Object -Property Length -Sum).Sum / 1MB, 1)
 Write-Host "  SoftwareDistribution\Download: $($sdFiles.Count) file(s), ${sdMB} MB remaining (WaaSMedicSvc best-effort, WU is disabled)."
 
-Assert-Step 'Cleanup' 'wuauserv StartType still Disabled after cache clear' {
+Assert-Step 'Cleanup' 'wuauserv StartType Disabled after cache clear' {
     (Get-Service wuauserv -ErrorAction Stop).StartType -eq 'Disabled'
 }
 } # end if (-not $SkipCleanup)