ci(windows): install ADK WinPE add-on so boot.wim collector can be staged

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/build-iso-windows.yaml

@@ -58,6 +58,28 @@ jobs:
           }
           if (-not (Test-Path $deploy)) { throw 'ADK Deployment Tools install failed.' }
 
+      - name: Ensure Windows ADK WinPE add-on
+        shell: pwsh
+        run: |
+          # build.ps1 (Invoke-ForceLegacySetup) calls Add-WindowsPackage with the
+          # WinPE_OCs cabs, which only exist if the ADK WinPE add-on is installed.
+          $ocs = 'C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs'
+          if (Test-Path $ocs) {
+            Write-Host 'ADK WinPE add-on (WinPE_OCs) already present.'; exit 0
+          }
+          Write-Host 'Installing ADK WinPE add-on...'
+          # Prefer winget; fall back to the WinPE add-on web installer.
+          $ok = $false
+          try { winget install --id Microsoft.ADKPEAddon -e --accept-source-agreements --accept-package-agreements --silent; $ok = $true } catch {}
+          if (-not $ok) {
+            # NOTE: fwlink id is ADK-version-specific; update if the channel rolls.
+            Invoke-WebRequest 'https://go.microsoft.com/fwlink/?linkid=2289981' -OutFile "$env:TEMP\adkwinpesetup.exe"
+            Start-Process "$env:TEMP\adkwinpesetup.exe" -ArgumentList '/quiet','/norestart','/features','OptionId.WindowsPreinstallationEnvironment' -Wait
+          }
+          # The WinPE collector is a required, core feature of this image, so a missing
+          # WinPE_OCs dir is a hard build gate (fail fast with a clear message).
+          if (-not (Test-Path $ocs)) { throw 'ADK WinPE add-on install failed (WinPE_OCs missing)' }
+
       - name: Setup .NET 9 SDK
         uses: actions/setup-dotnet@v4
         with: