fix(build): discard stale image mounts at startup + ephemeral CI WorkDir

A prior aborted build left a DISM image mounted in the fixed WorkDir,
locking install.wim and breaking the Stage 2 extract clean-up. Add a
Stage 0 that discards any orphaned SilverMetal mounts + loaded hives
before recreating the work dirs, and run CI in an ephemeral per-job
RUNNER_TEMP WorkDir so concurrent/aborted runs can't collide.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/build-iso-windows.yaml

@@ -132,6 +132,7 @@ jobs:
         run: |
           .\windows\installer\build.ps1 `
             -SourceIso '${{ steps.iso.outputs.path }}' `
+            -WorkDir "$env:RUNNER_TEMP\smbuild" `
             -OutputIso "$env:RUNNER_TEMP\out\SilverMetal-Enhanced-Windows.iso"
 
       - name: Validate baked payload (offline assertions)