fix OOBE locale skip + EMS-SAC install timeout

autounattend.xml:
- Add SystemLocale/UserLocale=en-GB + InputLocale=0409 (US keyboard)
  to windowsPE pass
- Fill in UILanguage/SystemLocale/UserLocale=en-GB in specialize
  (was UserLocale=en-US which mismatched en-GB image default)
- Add Microsoft-Windows-International-Core to oobeSystem pass --
  Win11 25H2 OOBE still prompts for country/keyboard unless all four
  locale fields are set here
- Wrap EMS-SAC Add-WindowsCapability in Start-Job with 20min timeout
  so a hung FoD download from Windows Update cannot block the rest
  of FirstLogonCommands indefinitely

scripts/verify.ps1:
- Relax VirtIO drivers check to >=2 (Balloon only present if host
  exposes virtio-balloon-pci, not in standard QEMU build)
- Add EMS-SAC Tools capability check

scripts/remediate.ps1:
- Use same Start-Job+timeout pattern for EMS-SAC re-install

Built image currently in LFS has UserLocale=en-US and no EMS-SAC
Tools -- needs rebuild to pick up these fixes.

Author: CMGS

autounattend.xml

@@ -5,6 +5,8 @@
       <SetupUILanguage><UILanguage>en-GB</UILanguage></SetupUILanguage>
       <InputLocale>0409:00000409</InputLocale>
       <UILanguage>en-GB</UILanguage>
+      <SystemLocale>en-GB</SystemLocale>
+      <UserLocale>en-GB</UserLocale>
     </component>
     <component name="Microsoft-Windows-PnpCustomizationsWinPE" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
       <DriverPaths>
@@ -53,10 +55,19 @@
     </component>
     <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
       <InputLocale>0409:00000409</InputLocale>
-      <UserLocale>en-US</UserLocale>
+      <SystemLocale>en-GB</SystemLocale>
+      <UILanguage>en-GB</UILanguage>
+      <UserLocale>en-GB</UserLocale>
     </component>
   </settings>
   <settings pass="oobeSystem">
+    <!-- V11: Force locale in oobeSystem to skip OOBE country/keyboard screens (Win11 25H2) -->
+    <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+      <InputLocale>0409:00000409</InputLocale>
+      <SystemLocale>en-GB</SystemLocale>
+      <UILanguage>en-GB</UILanguage>
+      <UserLocale>en-GB</UserLocale>
+    </component>
     <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
       <OOBE><HideEULAPage>true</HideEULAPage><HideOnlineAccountScreens>true</HideOnlineAccountScreens><HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE><ProtectYourPC>3</ProtectYourPC></OOBE>
       <UserAccounts><LocalAccounts><LocalAccount wcm:action="add"><Name>cocoon</Name><Group>Administrators</Group><Password><Value>QwBAAGMAIwBvAG4AMQA2ADAAUABhAHMAcwB3AG8AcgBkAA==</Value><PlainText>false</PlainText></Password></LocalAccount></LocalAccounts></UserAccounts>
@@ -73,7 +84,8 @@
         <SynchronousCommand wcm:action="add"><Order>9</Order><CommandLine>bcdedit /ems on</CommandLine></SynchronousCommand>
         <SynchronousCommand wcm:action="add"><Order>10</Order><CommandLine>bcdedit /bootems on</CommandLine></SynchronousCommand>
         <SynchronousCommand wcm:action="add"><Order>11</Order><CommandLine>sc config TermService start=auto</CommandLine></SynchronousCommand>
-        <SynchronousCommand wcm:action="add"><Order>12</Order><CommandLine>powershell -Command "Add-WindowsCapability -Online -Name Windows.Desktop.EMS-SAC.Tools~~~~0.0.1.0"</CommandLine></SynchronousCommand>
+        <!-- V11: EMS-SAC wrapped in 20min timeout (FoD download from Windows Update can hang) -->
+        <SynchronousCommand wcm:action="add"><Order>12</Order><CommandLine>powershell -Command "$j = Start-Job { Add-WindowsCapability -Online -Name Windows.Desktop.EMS-SAC.Tools~~~~0.0.1.0 }; if (Wait-Job $j -Timeout 1200) { Receive-Job $j } else { Stop-Job $j; Write-Output 'EMS-SAC install timed out after 20min' }; Remove-Job $j -Force"</CommandLine></SynchronousCommand>
         <!-- V10: Set network Private (required before WinRM AllowUnencrypted) -->
         <SynchronousCommand wcm:action="add"><Order>13</Order><CommandLine>powershell -Command "Get-NetConnectionProfile | Set-NetConnectionProfile -NetworkCategory Private"</CommandLine></SynchronousCommand>
         <!-- V10: WinRM for remote management -->

scripts/remediate.ps1

@@ -41,9 +41,20 @@ bcdedit /bootems on
 Set-Service -Name TermService -StartupType Automatic
 Start-Service TermService -ErrorAction SilentlyContinue
 
-# --- EMS-SAC tools ---
-$emsCap = Get-WindowsCapability -Online | Where-Object { $_.Name -match 'EMS-SAC' -and $_.State -ne 'Installed' }
-if ($emsCap) { Add-WindowsCapability -Online -Name Windows.Desktop.EMS-SAC.Tools~~~~0.0.1.0 }
+# --- EMS-SAC tools (20min timeout; FoD download can hang) ---
+$emsCap = Get-WindowsCapability -Online -Name "Windows.Desktop.EMS-SAC.Tools~~~~0.0.1.0"
+if ($emsCap.State -ne 'Installed') {
+    Write-Output "Installing EMS-SAC Tools (timeout 20min)..."
+    $j = Start-Job { Add-WindowsCapability -Online -Name Windows.Desktop.EMS-SAC.Tools~~~~0.0.1.0 }
+    if (Wait-Job $j -Timeout 1200) {
+        Receive-Job $j | Out-Null
+        Write-Output "EMS-SAC Tools installed"
+    } else {
+        Stop-Job $j
+        Write-Output "WARNING: EMS-SAC Tools install timed out"
+    }
+    Remove-Job $j -Force
+}
 
 # --- Network profile ---
 Get-NetConnectionProfile | Set-NetConnectionProfile -NetworkCategory Private

scripts/verify.ps1

@@ -77,14 +77,19 @@ Check "shutdownwithoutlogon = 1" ($swl -eq 1)
 Check "Hostname = COCOON-VM" ((hostname) -eq "COCOON-VM")
 
 # --- VirtIO drivers ---
+# Minimum 2 (viostor + NetKVM); Balloon only present if host exposes virtio-balloon device
 $vd = Get-WmiObject Win32_PnPSignedDriver | Where-Object { $_.DeviceName -match 'VirtIO' }
-Check "VirtIO drivers (>=3)" ($vd.Count -ge 3)
+Check "VirtIO drivers (>=2)" ($vd.Count -ge 2)
 
 # --- virtio-win guest tools ---
 $vgt = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
     Where-Object { $_.DisplayName -match 'Virtio-win' }
 Check "virtio-win guest tools installed" ($null -ne $vgt)
 
+# --- EMS-SAC Tools (FoD) ---
+$emsCap = Get-WindowsCapability -Online -Name "Windows.Desktop.EMS-SAC.Tools~~~~0.0.1.0"
+Check "EMS-SAC Tools capability installed" ($emsCap.State -eq "Installed")
+
 # --- Install marker ---
 Check "C:\install.success exists" (Test-Path C:\install.success)