Add build-windows-base.sh to build the Windows 11 base image

Installs Windows unattended from the ISO in a scratch VM (under /var/tmp
by default), generalizes it with sysprep over SSH and stores the shut-down
disk as the read-only base image that run-windows11.py clones.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

README.md

@@ -109,3 +109,22 @@ image is built without root. The ISO has to be read as UDF (its ISO 9660 side on
 holds a README): macOS uses `hdiutil`, Linux uses `mount -t udf` as root,
 otherwise `udisksctl`, otherwise `7z` extracts it into a temporary directory
 (which needs the free space of the whole ISO). The `*.img` file is ignored by Git.
+
+## Windows base image
+
+`run-windows11.py` creates a missing system disk as a QCOW2 overlay on the base
+image that `./download-images.sh --print-path windows11` prints, so a new VM does
+not run Windows Setup again. `build-windows-base.sh` makes that base image: it
+installs Windows unattended from the ISO in `install-iso/`, generalizes it with
+`sysprep` over SSH, and stores the shut-down disk read-only.
+
+```bash
+./build-windows-base.sh [--force] [--no-sysprep] [--compress] [OUTPUT.qcow2]
+```
+
+It refuses to replace an existing base image without `--force`, because the
+overlays of existing VMs still point at that file. Build to another `OUTPUT`
+(for example with a version in its name) and select it with
+`WIN11_VM_BASE_IMAGE` instead. The installation runs in a scratch directory
+`/var/tmp/build-windows-base.*` (set `BASE_BUILD_TMPDIR` to use another parent; about 25 GB are needed) and needs a private key that matches
+the public key put on the answer media.