fix(template): make prepare-win robust without prior Deploy run

- WinRM MaxProcessesPerShell: apply 100 if below threshold before asserting
- DesktopHeap SharedSection: apply 4096 KB registry value if below threshold before asserting
- Replace cleanmgr (hangs in WinRM Session 0, no window station) with direct
  PowerShell cleanup for dumps, WER files and Recycle Bin; DISM already covers
  component store and WU cache
- vcpkg git clone/checkout: wrap with EAP=Continue to suppress PS5.1
  NativeCommandError on git stderr (gotcha #3 from AGENTS.md)
- template.py: filter CI_EXITCODE:N marker from displayed output
- ci-static-ip.ps1: switch from vmware-rpctool (removed in recent Tools) to
  vmtoolsd --cmd; use temp-file redirect to capture output from native cmd

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

template/guest-setup/windows/ci-static-ip.ps1

@@ -31,16 +31,24 @@
 Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
 
-$vmtoolsRpc = 'C:\Program Files\VMware\VMware Tools\vmware-rpctool.exe'
-if (-not (Test-Path $vmtoolsRpc -PathType Leaf)) { exit 0 }
+# vmware-rpctool.exe was removed in recent VMware Tools versions; use vmtoolsd --cmd instead.
+$vmtoolsd = 'C:\Program Files\VMware\VMware Tools\vmtoolsd.exe'
+if (-not (Test-Path $vmtoolsd -PathType Leaf)) { exit 0 }
 
 function Read-GuestInfo {
     param([string]$Key)
-    $savedEap = $ErrorActionPreference; $ErrorActionPreference = 'Continue'
-    $out = & $vmtoolsRpc "info-get guestinfo.$Key" 2>&1
-    $ErrorActionPreference = $savedEap
-    if ($LASTEXITCODE -eq 0 -and $out -notmatch 'No value found|^$') {
-        return ($out | Out-String).Trim()
+    # vmtoolsd writes to a file handle but not to a PS pipeline — use cmd.exe redirection.
+    $tmp = [System.IO.Path]::GetTempFileName()
+    try {
+        $savedEap = $ErrorActionPreference; $ErrorActionPreference = 'Continue'
+        cmd /c "`"$vmtoolsd`" --cmd `"info-get guestinfo.$Key`" > `"$tmp`" 2>&1"
+        $ErrorActionPreference = $savedEap
+        $text = (Get-Content $tmp -ErrorAction SilentlyContinue | Out-String).Trim()
+        if ($text -and $text -notmatch 'No value found|Error') {
+            return $text
+        }
+    } finally {
+        Remove-Item $tmp -ErrorAction SilentlyContinue
     }
     return ''
 }
@@ -75,22 +83,22 @@ if (-not $adapter) {
     exit 1
 }
 
-# Disable DHCP and remove any existing IPv4 addresses.
+# Disable DHCP and remove any existing IPv4 addresses and routes.
 $adapter | Set-NetIPInterface -Dhcp Disabled -ErrorAction SilentlyContinue
+Get-NetRoute -InterfaceAlias $adapter.Name -AddressFamily IPv4 -ErrorAction SilentlyContinue |
+    Remove-NetRoute -Confirm:$false -ErrorAction SilentlyContinue
 $adapter | Get-NetIPAddress -AddressFamily IPv4 -ErrorAction SilentlyContinue |
     Remove-NetIPAddress -Confirm:$false -ErrorAction SilentlyContinue
 
-# Apply static IP.
-$ipParams = @{
-    InterfaceAlias = $adapter.Name
-    IPAddress      = $ip
-    PrefixLength   = $prefix
-    ErrorAction    = 'Stop'
-}
+# Apply static IP (no DefaultGateway here — add route separately to avoid conflicts).
+New-NetIPAddress -InterfaceAlias $adapter.Name -IPAddress $ip `
+    -PrefixLength $prefix -ErrorAction Stop | Out-Null
+
+# Add default route if gateway supplied.
 if ($gateway -match '^\d{1,3}(\.\d{1,3}){3}$') {
-    $ipParams['DefaultGateway'] = $gateway
+    New-NetRoute -InterfaceAlias $adapter.Name -DestinationPrefix '0.0.0.0/0' `
+        -NextHop $gateway -ErrorAction SilentlyContinue | Out-Null
 }
-New-NetIPAddress @ipParams | Out-Null
 
 # Use the gateway as DNS (fallback: Google DNS).
 $dns = @()
@@ -101,7 +109,7 @@ Set-DnsClientServerAddress -InterfaceAlias $adapter.Name `
 
 # Report IP back via guestinfo.ci-ip so the host also has it.
 $savedEap = $ErrorActionPreference; $ErrorActionPreference = 'Continue'
-& $vmtoolsRpc "info-set guestinfo.ci-ip $ip" 2>&1 | Out-Null
+& $vmtoolsd --cmd "info-set guestinfo.ci-ip $ip" 2>&1 | Out-Null
 $ErrorActionPreference = $savedEap
 
 exit 0