WIP: add Windows Update template with online COM API updates

Add essentials.windowsUpdate template that boots Audit Mode, uses the
Windows Update COM API to search/download/install all available updates
(cumulative, .NET, Defender), handles multi-round reboots with Audit
Mode preservation, and compacts the image afterward.

Known issues being worked:
- Audit Mode preservation after update reboot needs verification
- Install takes ~60-90 min with 4GB RAM on slow machines

See wip/win10-update.session.md for full context and TODOs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lib/images/windows/templates/default.nix

@@ -20,6 +20,7 @@ in rec {
     bestPerformance      = import ./essentials/best-performance.nix args;
     clearFileAssociations = import ./essentials/clear-file-associations.nix args;
     virtioDrivers   = import ./essentials/virtio-drivers.nix args;
+    windowsUpdate   = import ./essentials/windows-update.nix args;
   };
 
   # Applications