WIP: add Windows Update template with online COM API updates

Add essentials.windowsUpdate template that boots Audit Mode, uses the
Windows Update COM API to search/download/install all available updates
(cumulative, .NET, Defender), handles multi-round reboots with Audit
Mode preservation, and compacts the image afterward.

Known issues being worked:
- Audit Mode preservation after update reboot needs verification
- Install takes ~60-90 min with 4GB RAM on slow machines

Includes full session notes in wip/ with detailed test log, build
commands, issue analysis, timing data, and Claude memory files.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lib/images/windows/templates/generalize.nix

@@ -81,7 +81,7 @@ in
     powershell -Command "Get-AppxPackage *MicrosoftEdgeDevToolsClient* | Remove-AppxPackage -ErrorAction SilentlyContinue"
 
 
-    :: Re-install product key to restore licensing after sysprep
+    :: Re-install product key and licenses to restore activation IDs after sysprep
     cscript //nologo C:\Windows\System32\slmgr.vbs /ipk M7XTQ-FN8P6-TTKYV-9D4CC-J462D
     cscript //nologo C:\Windows\System32\slmgr.vbs /rilc
     :: Restart SPP service and wait for it to settle
@@ -95,7 +95,7 @@ in
     :: Activate Office using Ohook method (if Office is installed)
     if exist "C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE" (
       if exist C:\MAS_AIO.cmd (
-        echo. | call C:\MAS_AIO.cmd /Ohook >> C:\vmix-activation.log 2>&1
+        echo. | call C:\MAS_AIO.cmd /Ohook
       )
     )
     del /q C:\MAS_AIO.cmd 2>nul