generalize: finalize OOBE state under keepMachineSid, or the image reboots into Setup

The keepMachineSid image built and had everything right in the registry --
account, profile on D:, RDP enabled, MountedDevices intact -- but booted to a
black screen with no services. The shipped image was set to run windeploy.exe
(OOBE) on every boot: SetupType=2, OOBEInProgress=1, CmdLine=oobe\windeploy.exe.
On the target there is no unattend left for it to consume, so it hangs.

The cause is our shutdown in FirstLogonCommands. It cuts OOBE off before
windeploy finalizes and resets that Setup state itself. The /generalize path
finalizes it through its own specialize->oobe cycle; /oobe alone does not, so
the flags are left set. Clearing them in post-oobe, only under keepMachineSid,
sends the target straight to logon. The default /generalize path is untouched.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0117qMyjpuXsjpVAcpJbFD8g

lib/images/windows/templates/generalize.nix

@@ -362,6 +362,16 @@ in
     reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "vmixUwf" /t REG_SZ /d "C:\vmix-uwf-config.cmd" /f
     ''}
 
+
+    ${lib.optionalString keepMachineSid ''
+    :: /oobe without /generalize leaves the system set to re-run windeploy (OOBE)
+    :: on every boot -- shutting down here in a FirstLogonCommand cuts OOBE off
+    :: before it resets that state itself. Clear it, or the target boots into a
+    :: Setup with no unattend left to consume and hangs on a black screen.
+    reg add "HKLM\SYSTEM\Setup" /v SetupType /t REG_DWORD /d 0 /f
+    reg delete "HKLM\SYSTEM\Setup" /v OOBEInProgress /f 2>nul
+    reg delete "HKLM\SYSTEM\Setup" /v CmdLine /f 2>nul
+    ''}
     :: Clean up
     del /q C:\oobe-unattend.xml 2>nul
     del /q C:\vmix-audit-script.cmd 2>nul