Refactor Win11 Creator ISO workflow (#4862)

* refactor: simplify Win11 Creator ISO workflow

Keep no-driver ISO generation on the fast copy-only path.

Inject exported drivers with one selected-index WIM mount, one Add-Driver pass, and one commit.

Limit WinPE staging to boot-storage drivers and improve workflow validation coverage.

* refactor: stage Win11 setup script fallback

Copy the prepared setup script payloads into sources/$//Setup/Scripts so setup media does not depend solely on answer-file extension extraction.

Keep the existing autounattend execution path unchanged and cover the fallback files in the Win11 Creator tests.

* refactor: address codex feedback

* refactor: run ISO verification in runspace

Rename the ISO logger to Write-WinUtilISOLog so the shared runspace pool imports it automatically. Run Mount & Verify off the WPF thread with dispatcher-safe UI updates, and add Pester coverage for the runspace and logger contract.

* refactor: address ISO review feedback

Keep the selected ISO stable during background verification. Apply ContentDeliveryManager settings to both the first account and the default profile. Block FAT32 USB creation when install.esd exceeds the supported file size.

* refactor: address ISO setup edge cases

Set BypassNRO before OOBE so local account setup is available during Windows Setup.

Detect registered DISM mounts during driver-injection cleanup so partial mount failures are discarded.

* refactor: address ISO review edge cases

Use the actual FAT32 file limit for install.esd USB checks.

Disable ISO modification while mount verification is running.

Apply unsupported-hardware notice suppression to the first user profile.

* refactor: stage ISO setup safeguards earlier

Set device encryption and reserved-storage registry guards before OOBE.

Enable the OEM configuration-set fallback when setup scripts are staged there.

* Update functions/private/Invoke-WinUtilISOUSB.ps1

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

---------

Co-authored-by: Chris Titus <contact@christitus.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

AGENTS.md

@@ -189,5 +189,6 @@ When the user corrects an agent approach, add or tighten one concrete rule here
 - When the active log file is owned by `Start-Transcript`, do not call `Add-Content` against that file; write to host output so the transcript captures the line in the same log file without recording a terminating-error diagnostic.
 - Log install/uninstall package names and package-manager IDs before queuing background runspace work; do not rely on runspace host output for the package identity.
 - For Win11 Creator, start each new ISO modification in a fresh `WinUtil_Win11ISO_*` temp directory; existing-work detection is only for resuming/exporting already modified media.
+- For Win11 Creator driver injection, keep offline WIM servicing to one mount, one `/Add-Driver`, and one commit; do not export editions or run unrelated WIM cleanup, and reject damaged metadata before ISO export.
 - For Script Analyzer cleanup, fix actionable source warnings first and do not globally suppress accepted convention warnings such as plural names, `ShouldProcess` on UI helpers, `$global:sync`, or compile-time cross-file false positives.
 - For DNS DHCP reset, keep the cmdlet reset and explicitly set IPv4 and IPv6 DNS source to DHCP.