[Regstar2]

Goal

Consolidate the remaining v1.0.0 blockers discovered by real Windows 11 25H2 E2E validation into one bounded release-hardening PR.

Closes #17
Closes #19
Closes #20
Closes #21
Closes #22
Closes #24

Supersedes Draft PRs #16 and #18; their relevant changes are folded into this branch so there is one review/validation surface.

Fixes

Requested install image format

• map converter AutoStart to upstream semantics: WIM=1, ESD=2;
• use wim2esd=1 for the ESD + integrated-updates path where the converter creates an intermediate WIM;
• avoid redundant end conversion for ESD when update integration is off;
• enforce the requested install-image format during mounted ISO verification, returning structured ISO_VALIDATION_FAILED on mismatch.

Windows PowerShell 5.1 POST

• retain the tested compatibility path that passes the form pair collection as one FormUrlEncodedContent constructor argument;
• preserve Network Policy and proxy error semantics.

Build-time defaults and diagnostics

• Cleanup defaults to OFF in both BuildPlan and GUI; explicit Cleanup remains supported;
• after a successful real ESD + integrated-updates E2E measured at 1:42:45, integrated updates now also default to OFF in BuildPlan and GUI;
• explicit update integration remains fully supported and keeps the required ESD wim2esd path;
• the Advanced options label warns that update integration can significantly increase build time;
• Store Apps, WinRE and other image-content behavior is unchanged;
• timestamp every converter-detail-log line so expensive phases can be measured from real builds.

Build liveness

• keep the real determinate percentage;
• add a passive indeterminate activity indicator while the build/cancellation panel is active.

Broken Win32 icon resource

• regenerate a bounded multi-size ICO from the current W Disc artwork;
• strengthen icon regression checks for entry offsets/lengths and PNG/DIB payloads.

Release artifacts

• keep the complete portable ZIP containing GUI + PowerShell CLI/backend + docs;
• additionally build a single self-extracting EXE launcher containing the exact validated ZIP payload;
• the EXE extracts to a unique temporary directory, launches the same packaged GUI/backend, forwards arguments, waits for completion, and performs best-effort cleanup;
• package creation runs --backend-smoke for both the normal packaged GUI and the standalone EXE;
• produce SHA-256 sidecars for both artifacts.

Compatibility

• ApplicationVersion remains 1.0.0;
• PowerShell ModuleVersion remains 0.3.0;
• Backend Contract remains v1;
• BuildPlan schema remains v1;
• no new public PowerShell API;
• existing resumable UUP work/cache is preserved;
• standalone EXE is only a packaging/launcher layer and does not introduce a second build backend.

Verification

The previous real Windows 11 25H2 x64 ru-RU Professional ESD + integrated-updates build completed successfully and produced a validated result, while providing the timing data that motivated #24.

Before merge/release on the new exact head:

• current-head automated full validation must pass;
• build both release artifacts and confirm both package smoke checks pass;
• run one real ESD build with the new default AddUpdates=false path and confirm sources\install.esd is present;
• complete the remaining manual GUI/network acceptance and full Git-history secret audit required by the validation matrix/release requirements.

[Regstar2]

Checkpoint after consolidated release-hardening validation:

• self-hosted Windows validation run #192: PASS;
• required release checks: 12/12 PASS;
• Pester: 224 passed / 0 failed / 1 skipped;
• GUI tests: 71/71 passed;
• PS5.1 + PS7 backend smoke: PASS;
• release package smoke: PASS;
• GUI startup smoke: PASS;
• ESD/WIM configuration and format-mismatch regressions: PASS;
• Cleanup default now OFF while explicit Cleanup remains supported;
• converter detail log now records ISO-8601 timestamps for future performance decomposition;
• build liveness indicator regression: PASS;
• regenerated ICO compiles successfully and bounded-entry validation passes.

Manual gate still required before merge: rerun the same real Windows 11 25H2 ESD build from the retained cache/work directory and verify sources\install.esd exists, the build completes successfully, and the activity indicator remains visibly active during quiet phases. The previous real converter log shows the build spending substantial work in Microsoft Store/UUP acquisition and image compression, so no content-changing speed hacks were introduced; the safe default-time reduction in this PR is disabling Cleanup unless explicitly requested.