feat: add integration test infra and bootstrapper updates

test/integration/packer/scripts/compact.ps1

@@ -0,0 +1,25 @@
+# Zero out free space so the resulting .box file is small.
+#
+# Runs last, just before Packer initiates shutdown. Cleans caches and the WU
+# component store, which directly shrinks the on-disk footprint of the VHDX.
+# We intentionally do not call `cipher /w:C:\` here: it costs 15–30 minutes
+# and its only payoff is better tarball compression of unused space, which
+# only matters when shipping the box. Re-add it before publishing publicly.
+
+$ErrorActionPreference = 'Continue'
+
+# Clean Windows Update download cache and component store.
+Stop-Service -Name wuauserv -Force -ErrorAction SilentlyContinue
+Remove-Item  -Path "$env:WINDIR\SoftwareDistribution\Download\*" -Recurse -Force -ErrorAction SilentlyContinue
+& dism /Online /Cleanup-Image /StartComponentCleanup /ResetBase /Quiet
+
+# Empty Recycle Bin and temp dirs.
+Get-ChildItem -Path "$env:TEMP" -Force -ErrorAction SilentlyContinue |
+  Remove-Item -Recurse -Force -ErrorAction SilentlyContinue
+Clear-RecycleBin -Force -ErrorAction SilentlyContinue
+
+# Light defrag pass to consolidate free extents. Quick on an SSD-backed VHDX.
+& defrag C: /U /V
+
+# Drop hibernation file (Windows 11 has it on by default).
+& powercfg /h off

test/integration/packer/scripts/configure-os.ps1

@@ -0,0 +1,28 @@
+# Generic OS tweaks applied after WinRM is reachable.
+#
+# Idempotent; safe to rerun.
+
+$ErrorActionPreference = 'Stop'
+
+# Make sure the remote-elevated token policy survives any unattended changes.
+$policy = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'
+New-ItemProperty -Path $policy -Name 'LocalAccountTokenFilterPolicy' `
+  -PropertyType DWord -Value 1 -Force | Out-Null
+
+# Disable telemetry "Connected User Experiences" service to avoid background
+# network noise that competes with the bootstrapper.
+$svc = Get-Service -Name DiagTrack -ErrorAction SilentlyContinue
+if ($svc) {
+    Set-Service -Name DiagTrack -StartupType Disabled
+    Stop-Service -Name DiagTrack -Force -ErrorAction SilentlyContinue
+}
+
+# Disable SmartScreen network checks (slows winget installs in the lab).
+$ss = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System'
+New-Item -Path $ss -Force | Out-Null
+New-ItemProperty -Path $ss -Name 'EnableSmartScreen' -PropertyType DWord -Value 0 -Force | Out-Null
+
+# Force NTP resync; Hyper-V time-sync after sysprep can drift, which breaks
+# TLS handshakes against winget / GitHub.
+Start-Service -Name w32time -ErrorAction SilentlyContinue
+& w32tm /resync /force 2>&1 | Out-Null

test/integration/packer/scripts/disable-defender-cloud.ps1

@@ -0,0 +1,12 @@
+# Turn off Defender cloud-delivered protection and sample submission.
+#
+# Cloud lookups add tens of seconds per winget install on a cold box and have
+# no value in an ephemeral integration VM.
+
+$ErrorActionPreference = 'Continue'
+
+Set-MpPreference -MAPSReporting Disabled                 -ErrorAction SilentlyContinue
+Set-MpPreference -SubmitSamplesConsent NeverSend         -ErrorAction SilentlyContinue
+Set-MpPreference -DisableBlockAtFirstSeen $true          -ErrorAction SilentlyContinue
+Set-MpPreference -DisableIOAVProtection $true            -ErrorAction SilentlyContinue
+Set-MpPreference -ScanAvgCPULoadFactor 5                 -ErrorAction SilentlyContinue

test/integration/packer/scripts/disable-windows-updates.ps1

@@ -0,0 +1,26 @@
+# Disable Windows Update on the gold image so it doesn't fight with the
+# bootstrapper's own WindowsUpdateCommand step at integration-test time.
+#
+# This is the precise mitigation for the 6-hour CI hang investigation: by
+# the time the bootstrapper runs, no other process is holding the WU agent.
+
+$ErrorActionPreference = 'Stop'
+
+$au = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU'
+New-Item -Path $au -Force | Out-Null
+New-ItemProperty -Path $au -Name 'NoAutoUpdate'            -PropertyType DWord -Value 1 -Force | Out-Null
+New-ItemProperty -Path $au -Name 'AUOptions'               -PropertyType DWord -Value 1 -Force | Out-Null
+New-ItemProperty -Path $au -Name 'ScheduledInstallDay'     -PropertyType DWord -Value 0 -Force | Out-Null
+New-ItemProperty -Path $au -Name 'NoAutoRebootWithLoggedOnUsers' -PropertyType DWord -Value 1 -Force | Out-Null
+
+$wu = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate'
+New-Item -Path $wu -Force | Out-Null
+New-ItemProperty -Path $wu -Name 'DoNotConnectToWindowsUpdateInternetLocations' -PropertyType DWord -Value 1 -Force | Out-Null
+
+foreach ($svc in 'wuauserv','UsoSvc','WaaSMedicSvc') {
+    $s = Get-Service -Name $svc -ErrorAction SilentlyContinue
+    if ($s) {
+        Set-Service -Name $svc -StartupType Disabled -ErrorAction SilentlyContinue
+        Stop-Service -Name $svc -Force -ErrorAction SilentlyContinue
+    }
+}

test/integration/packer/scripts/install-vagrant-key.ps1

@@ -0,0 +1,15 @@
+# Install the Vagrant insecure SSH key marker so `vagrant ssh-config` and
+# tooling that expects the Vagrant-flavoured user account is happy. WinRM is
+# the actual communicator, but several Vagrant plugins probe for this layout.
+
+$ErrorActionPreference = 'Continue'
+
+$sshDir = "$env:USERPROFILE\.ssh"
+New-Item -ItemType Directory -Path $sshDir -Force | Out-Null
+
+$keyUrl = 'https://raw.githubusercontent.com/hashicorp/vagrant/main/keys/vagrant.pub'
+try {
+    Invoke-WebRequest -UseBasicParsing -Uri $keyUrl -OutFile "$sshDir\authorized_keys"
+} catch {
+    Write-Host "warning: could not fetch vagrant insecure public key: $($_.Exception.Message)"
+}