新增 Setup.ps1（13 段 post-install）；FirstLogonCommands 改從 Ventoy USB 拷腳本

把分散在 unattend.xml inline 的網路相依步驟（OpenSSH/Telegram/RemoveAI）和
新加入的 10 個 post-install 動作整合進獨立的 Setup.ps1，由 FirstLogonCommands
Order 4 從 Ventoy USB（/ventoy/script/Setup.ps1）掃磁碟複製到 C:\Scripts\，
Order 5 執行。腳本分兩 phase：

Phase 1（不需網路）：SSH 22 防火牆、RDP+3389、ICMP Echo、WinRM TrustedHosts=*、
移 OneDrive、關 Cortana/WebSearch、套 UI/IME 預設到 Default profile、user→User
改名 + 從登入畫面隱藏 Admin。

Phase 2（要網路，wait-network 後）：OpenSSH Server FoD、KMS 啟用（先試
$InternalKmsServers 後 fallback 公開 KMS）、winget Chrome、RemoveWindowsAI、
Win11Debloat、22 個 UWP 移除、Telegram、刪 Panther 殘留。

每段以 Section 包裝寫獨立 START/DONE/ERR 到 C:\Windows\Temp\setup.log，方便逐段
重跑與排查。

文件全部同步：DEPLOY/QUICKSTART/SUMMARY/README/CLAUDE 都加上 Setup.ps1 的
USB 部署、cp 步驟、Order 表、排查指引。

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

unattend.xml

@@ -148,44 +148,45 @@
         </Password>
       </AutoLogon>
 
-      <!-- 首次登入執行的自訂腳本 -->
+      <!-- 首次登入執行的自訂腳本
+
+           前 4 條為「不需網路、可獨立成功」的本機指令；
+           Order 5 從 Ventoy USB 把 Setup.ps1 複製到 C:\Scripts\，
+           Order 6 跑 Setup.ps1（13 項 post-install 動作集中在那裡），
+           Order 7 重開機。
+
+           各條都會寫獨立 log 到 C:\Windows\Temp\，方便排查無聲失敗。 -->
       <FirstLogonCommands>
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
-          <CommandLine>powershell.exe -ExecutionPolicy Bypass -File C:\Scripts\Setup.ps1</CommandLine>
-          <Description>執行部署後設定腳本</Description>
-          <RequiresUserInput>false</RequiresUserInput>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>2</Order>
           <CommandLine>cmd.exe /c net accounts /maxpwage:unlimited</CommandLine>
           <Description>密碼永不過期</Description>
         </SynchronousCommand>
         <SynchronousCommand wcm:action="add">
-          <Order>3</Order>
+          <Order>2</Order>
           <CommandLine>powershell.exe -NoProfile -Command "Rename-Computer -NewName ('PC-' + (Get-Random -Minimum 10000 -Maximum 100000)) -Force"</CommandLine>
           <Description>主機名改成 PC-XXXXX（重開後生效）</Description>
         </SynchronousCommand>
         <SynchronousCommand wcm:action="add">
-          <Order>4</Order>
+          <Order>3</Order>
           <CommandLine>cmd.exe /c "net user user 1234 /add &amp; net user user /logonpasswordchg:yes"</CommandLine>
-          <Description>建立本機帳號 user（密碼 1234，首次登入強制改密）</Description>
+          <Description>建立本機帳號 user（密碼 1234，首次登入強制改密；之後 Setup.ps1 會把它改名成 User）</Description>
+          <RequiresUserInput>false</RequiresUserInput>
+        </SynchronousCommand>
+        <SynchronousCommand wcm:action="add">
+          <Order>4</Order>
+          <CommandLine>powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$log='C:\Windows\Temp\firstlogon-copysetup.log'; New-Item -ItemType Directory -Force -Path C:\Scripts | Out-Null; $src=$null; foreach ($d in (Get-PSDrive -PSProvider FileSystem -EA 0).Root) { $cand=Join-Path $d 'ventoy\script\Setup.ps1'; if (Test-Path $cand) { $src=$cand; break } }; if ($src) { Copy-Item $src 'C:\Scripts\Setup.ps1' -Force; ('OK from ' + $src + ' at ' + (Get-Date -Format o)) | Out-File $log -Append } else { ('NOT FOUND at ' + (Get-Date -Format o)) | Out-File $log -Append }"</CommandLine>
+          <Description>從 Ventoy USB 的 \ventoy\script\Setup.ps1 複製到 C:\Scripts\（log: firstlogon-copysetup.log）</Description>
           <RequiresUserInput>false</RequiresUserInput>
         </SynchronousCommand>
         <SynchronousCommand wcm:action="add">
           <Order>5</Order>
-          <CommandLine>powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$log='C:\Windows\Temp\firstlogon-sshd.log'; $i=0; while ($i -lt 30 -and -not (Test-Connection 8.8.8.8 -Count 1 -Quiet -EA 0)) { Start-Sleep 2; $i++ }; ('NetWait=' + ($i*2) + 's') | Out-File $log -Append; try { Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 -EA Stop | Out-Null; Set-Service sshd -StartupType Automatic -EA Stop; Start-Service sshd -EA Stop; ('OK ' + (Get-Date -Format o)) | Out-File $log -Append } catch { ('ERR ' + $_.Exception.Message) | Out-File $log -Append }"</CommandLine>
-          <Description>等網路→安裝並啟用 OpenSSH Server（log: firstlogon-sshd.log）</Description>
+          <CommandLine>cmd.exe /c "if exist C:\Scripts\Setup.ps1 (powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\Scripts\Setup.ps1) else (echo SETUP_NOT_FOUND %DATE% %TIME% &gt; C:\Windows\Temp\firstlogon-runsetup.log)"</CommandLine>
+          <Description>執行 Setup.ps1（13 項 post-install：SSH/RDP/WinRM/KMS/Chrome/Debloat/Telegram/RemoveAI/UI/IME/重命名帳號…，log: C:\Windows\Temp\setup.log）</Description>
           <RequiresUserInput>false</RequiresUserInput>
         </SynchronousCommand>
         <SynchronousCommand wcm:action="add">
           <Order>6</Order>
-          <CommandLine>powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$log='C:\Windows\Temp\firstlogon-telegram.log'; [Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12; $ProgressPreference='SilentlyContinue'; $p=Join-Path $env:TEMP 'tsetup.exe'; $i=0; while ($i -lt 30 -and -not (Test-Connection 8.8.8.8 -Count 1 -Quiet -EA 0)) { Start-Sleep 2; $i++ }; ('NetWait=' + ($i*2) + 's') | Out-File $log -Append; try { ('Start ' + (Get-Date -Format o)) | Out-File $log -Append; Invoke-WebRequest -UseBasicParsing -Uri 'https://telegram.org/dl/desktop/win64' -OutFile $p; ('Downloaded ' + (Get-Item $p).Length + 'B') | Out-File $log -Append; $proc=Start-Process -FilePath $p -ArgumentList '/VERYSILENT','/SUPPRESSMSGBOXES','/NORESTART' -Wait -PassThru; ('Exit ' + $proc.ExitCode) | Out-File $log -Append } catch { ('ERR ' + $_.Exception.Message) | Out-File $log -Append }"</CommandLine>
-          <Description>下載並靜默安裝 Telegram Desktop（log: firstlogon-telegram.log）</Description>
-          <RequiresUserInput>false</RequiresUserInput>
-        </SynchronousCommand>
-        <SynchronousCommand wcm:action="add">
-          <Order>7</Order>
           <CommandLine>shutdown /r /t 5</CommandLine>
           <Description>完成後重開機</Description>
         </SynchronousCommand>