fix(template): move disk cleanup after final reboot, before shutdown

Cleanup now runs after the system reboots post-install (fully settled
state), not right after the WU loop. Sequence: WU loop → static IP →
validation → final reboot → WinRM ready → [cleanup] → autologin →
shutdown → snapshot.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/ci_orchestrator/commands/template.py

@@ -567,33 +567,6 @@ def template_prepare_win(
             _wait_winrm(transport, winrm_timeout)
             click.echo("[prepare-win] WinRM ready after reboot.")
 
-        # Post-update disk cleanup — runs once after all WU reboots complete
-        if not skip_cleanup:
-            click.echo("[prepare-win] Running post-update disk cleanup (-CleanupOnly) ...")
-            cleanup_invoke = (
-                "Set-ExecutionPolicy Bypass -Scope Process -Force\n"
-                "$ec = 0\n"
-                "try {\n"
-                f"    & '{e(guest_script)}' -BuildPassword '{e(build_password)}'"
-                f" -BuildUsername '{e(build_username)}'"
-                f" -AdminPassword '{e(admin_password)}' -CleanupOnly:$true\n"
-                "    $ec = if ($null -eq $LASTEXITCODE) { 0 } else { $LASTEXITCODE }\n"
-                "} catch {\n"
-                "    Write-Error $_\n"
-                "    $ec = 1\n"
-                "}\n"
-                '"CI_EXITCODE:$ec"\n'
-            )
-            cleanup_result = _run_with_heartbeat(transport, cleanup_invoke, check=False)
-            cleanup_ec = _parse_exit_marker(cleanup_result.stdout)
-            if cleanup_result.stdout.strip():
-                click.echo(cleanup_result.stdout.strip())
-            if cleanup_result.stderr.strip():
-                click.echo(cleanup_result.stderr.strip(), err=True)
-            if cleanup_ec != 0:
-                raise click.ClickException(f"Disk cleanup failed (exit {cleanup_ec}).")
-            click.echo("[prepare-win] Post-update cleanup complete.")
-
         # Install CI-StaticIp scheduled task
         if static_ip_path is not None:
             click.echo("[prepare-win] Installing CI-StaticIp scheduled task ...")
@@ -666,6 +639,33 @@ Register-ScheduledTask -TaskName 'CI-StaticIp' `
         click.echo("[prepare-win] Waiting for WinRM after final reboot ...")
         _wait_winrm(transport, winrm_timeout)
 
+        # Disk cleanup — runs after final reboot on fully-installed system
+        if not skip_cleanup:
+            click.echo("[prepare-win] Running post-update disk cleanup (-CleanupOnly) ...")
+            cleanup_invoke = (
+                "Set-ExecutionPolicy Bypass -Scope Process -Force\n"
+                "$ec = 0\n"
+                "try {\n"
+                f"    & '{e(guest_script)}' -BuildPassword '{e(build_password)}'"
+                f" -BuildUsername '{e(build_username)}'"
+                f" -AdminPassword '{e(admin_password)}' -CleanupOnly:$true\n"
+                "    $ec = if ($null -eq $LASTEXITCODE) { 0 } else { $LASTEXITCODE }\n"
+                "} catch {\n"
+                "    Write-Error $_\n"
+                "    $ec = 1\n"
+                "}\n"
+                '"CI_EXITCODE:$ec"\n'
+            )
+            cleanup_result = _run_with_heartbeat(transport, cleanup_invoke, check=False)
+            cleanup_ec = _parse_exit_marker(cleanup_result.stdout)
+            if cleanup_result.stdout.strip():
+                click.echo(cleanup_result.stdout.strip())
+            if cleanup_result.stderr.strip():
+                click.echo(cleanup_result.stderr.strip(), err=True)
+            if cleanup_ec != 0:
+                raise click.ClickException(f"Disk cleanup failed (exit {cleanup_ec}).")
+            click.echo("[prepare-win] Post-update cleanup complete.")
+
         # Re-affirm autologin
         click.echo("[prepare-win] Re-affirming autologin registry settings ...")
         transport.run(