Fix registry ownership/ACL and hang bugs in tiny11maker.ps1, plus build/setup script updates

Fixes several offline-hive build failures: TrustedInstaller-owned keys
(WindowsRuntime\ActivatableClassId, Explorer\Advanced, System\GameConfigStore, Search
SystemIndex) denying writes even to admin-owned processes, a PowerShell 5.1 quirk that drops
empty-string reg.exe arguments and can hang the build on a silent overwrite prompt, a
registry-handle leak that left hives locked and cascaded into DISM cleanup failures, and
relaxed the post-ResetBase health gate to accept 'Repairable' (only abort on
'NonRepairable') since ResetBase makes full repair impossible anyway - documented that
repairing the installed OS needs the original stock ISO, not the tweaked output. Also
rolls in in-progress updates to the other maker scripts and OEM setup/first-boot scripts.

includes/utils/ResourceHacker.ini

@@ -1,6 +1,6 @@
 [MRU List]
 MRU1=C:\Users\oxmc\Documents\Github\CustomTiny11\working\tiny11\sources\spwizimg.dll
-MRU2=C:\Users\oxmc\Documents\Github\CustomTiny11\working\tiny10\sources\spwizimg.dll
+MRU2=
 MRU3=
 MRU4=
 MRU5=

includes/utils/change-bootres.ps1

@@ -16,8 +16,10 @@ param(
     
     [Parameter(Mandatory = $false)]
     [string]$PfxPassword = "",
-    
-    [switch]$UseLegacySizes
+
+    [switch]$UseLegacySizes,
+
+    [switch]$IgnoreSecBoot
 )
 
 #Requires -RunAsAdministrator
@@ -253,6 +255,14 @@ function Sign-FileWithCertificate {
     }
 }
 
+# Function to create a throwaway self-signed code-signing cert (IgnoreSecBoot path only)
+function New-ThrowawaySigningCert {
+    $cert = New-SelfSignedCertificate -Type CodeSigningCert -Subject "CN=CustomTiny11 IgnoreSecBoot" `
+        -CertStoreLocation "Cert:\CurrentUser\My" -KeyExportPolicy Exportable -KeyUsage DigitalSignature `
+        -NotAfter (Get-Date).AddYears(5)
+    return $cert
+}
+
 # Function to resize bitmap
 function Resize-Bitmap {
     param(
@@ -412,6 +422,12 @@ try {
             $signed = Sign-FileWithCertificate -FilePath $outputDll -SignToolPath $signToolPath `
                 -CertificateThumbprint $CertificateThumbprint -PfxPath $PfxPath -PfxPassword $PfxPassword
         }
+        elseif ($IgnoreSecBoot) {
+            Write-Log "IgnoreSecBoot set and no certificate given - generating throwaway self-signed cert..." -Color "Yellow"
+            $throwawayCert = New-ThrowawaySigningCert
+            $signed = Sign-FileWithCertificate -FilePath $outputDll -SignToolPath $signToolPath `
+                -CertificateThumbprint $throwawayCert.Thumbprint
+        }
         else {
             Write-Log "No certificate specified. Skipping code signing." -Color "Yellow"
         }
@@ -439,7 +455,16 @@ try {
         Write-Host "[!] File is NOT signed" -ForegroundColor Yellow
         Write-Host "    Requires Test Signing mode or Secure Boot disabled" -ForegroundColor Gray
     }
-    
+
+    if ($IgnoreSecBoot) {
+        Write-Host ""
+        Write-Host "[IgnoreSecBoot] Signed with throwaway cert (not Microsoft-trusted)." -ForegroundColor Yellow
+        Write-Host "  Build the image with -IgnoreSecBoot on the maker script too - it flags first boot" -ForegroundColor Gray
+        Write-Host "  to run 'bcdedit /set testsigning on' and 'bcdedit /set nointegritychecks on'." -ForegroundColor Gray
+        Write-Host "  Those settings are IGNORED by Windows while Secure Boot is on in firmware." -ForegroundColor Gray
+        Write-Host "  Secure Boot must be disabled manually in UEFI setup for this to boot." -ForegroundColor Gray
+    }
+
     # Copy final DLL to script directory
     $FinallDLL = Join-Path $PSScriptRoot "bootres_modified.dll"
     Copy-Item -Path $outputDll -Destination $FinallDLL -Force

includes/utils/patch-iso-autounattend.ps1

@@ -6,6 +6,36 @@ param(
 
 $projectRoot = (Resolve-Path "$PSScriptRoot\..\..")
 
+# Detect Windows 10 vs 11 from install.wim/install.esd so the right autounattend variant gets injected
+function Get-WindowsVersionFromMedia {
+    param([string]$MediaRoot)
+
+    $srcBase = $MediaRoot
+    if (-not (Test-Path "$srcBase\sources\install.wim") -and -not (Test-Path "$srcBase\sources\install.esd") -and (Test-Path "$srcBase\x64\sources")) {
+        $srcBase = "$srcBase\x64"
+    }
+
+    $imagePath = if (Test-Path "$srcBase\sources\install.wim") { "$srcBase\sources\install.wim" }
+                 elseif (Test-Path "$srcBase\sources\install.esd") { "$srcBase\sources\install.esd" }
+                 else { $null }
+
+    if (-not $imagePath) { return $null }
+
+    try {
+        $imgInfo = Get-WindowsImage -ImagePath $imagePath -Index 1
+        $parts = $imgInfo.Version.Split('.')
+        if ($parts.Count -ge 3) {
+            $build = [int]$parts[2]
+            if ($build -ge 22000) { return "11" }
+            elseif ($build -ge 10240) { return "10" }
+        }
+    }
+    catch {
+        Write-Warning "Could not read Windows version from media: $($_.Exception.Message)"
+    }
+    return $null
+}
+
 if (-not (Test-Path $IsoPath)) {
     Write-Error "ISO not found: $IsoPath"
     exit 1
@@ -81,18 +111,31 @@ try {
         }
     }
 
-    # Replace autounattend.xml
-    $newXml = "$projectRoot\includes\autounattend-win10.xml"
+    # Detect Windows version so we inject the matching autounattend variant
+    Write-Host "Detecting Windows version from media..."
+    $detectedVersion = Get-WindowsVersionFromMedia -MediaRoot $tempDir
+    if (-not $detectedVersion) {
+        Write-Host "Could not automatically detect Windows version from media."
+        do {
+            $detectedVersion = Read-Host "Enter Windows version (10 or 11)"
+        } while ($detectedVersion -notin @("10", "11"))
+    }
+    else {
+        Write-Host "Detected Windows $detectedVersion media."
+    }
+
+    # Replace autounattend.xml with the version-matched variant
+    $newXml = "$projectRoot\includes\autounattend-win$detectedVersion.xml"
     if (-not (Test-Path $newXml)) {
-        Write-Error "autounattend-win10.xml not found at: $newXml"
+        Write-Error "autounattend-win$detectedVersion.xml not found at: $newXml"
         exit 1
     }
-    Write-Host "Replacing autounattend.xml..."
+    Write-Host "Replacing autounattend.xml with autounattend-win$detectedVersion.xml..."
     Copy-Item -Path $newXml -Destination "$tempDir\autounattend.xml" -Force
 
-    # Detect label from ISO filename
+    # Detect label from ISO filename, tagged with the detected version
     $isoName = [System.IO.Path]::GetFileNameWithoutExtension($IsoPath)
-    $label = if ($isoName -match 'x86') { "Tiny10_x86" } else { "Tiny10_x64" }
+    $label = if ($isoName -match 'x86') { "Tiny${detectedVersion}_x86" } else { "Tiny${detectedVersion}_x64" }
 
     $bootEtfs = "$tempDir\boot\etfsboot.com"
     $bootEfi  = "$tempDir\efi\microsoft\boot\efisys.bin"