Fix registry ownership/ACL and hang bugs in tiny11maker.ps1, plus build/setup script updates

Fixes several offline-hive build failures: TrustedInstaller-owned keys
(WindowsRuntime\ActivatableClassId, Explorer\Advanced, System\GameConfigStore, Search
SystemIndex) denying writes even to admin-owned processes, a PowerShell 5.1 quirk that drops
empty-string reg.exe arguments and can hang the build on a silent overwrite prompt, a
registry-handle leak that left hives locked and cascaded into DISM cleanup failures, and
relaxed the post-ResetBase health gate to accept 'Repairable' (only abort on
'NonRepairable') since ResetBase makes full repair impossible anyway - documented that
repairing the installed OS needs the original stock ISO, not the tweaked output. Also
rolls in in-progress updates to the other maker scripts and OEM setup/first-boot scripts.

tiny10maker.ps1

@@ -6,7 +6,8 @@ param (
     [string]$ScratchDisk,
     [string]$windowsisopath,
     [string]$imageindex,
-    [switch]$UseSetupTemplate
+    [switch]$UseSetupTemplate,
+    [switch]$IgnoreSecBoot
 )
 
 if (-not $ScratchDisk) {
@@ -542,6 +543,10 @@ Write-Host "Bypassing system requirements(on the system image):"
 & 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassTPMCheck' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
 & 'reg' 'add' 'HKLM\zSYSTEM\Setup\MoSetup' '/v' 'AllowUpgradesWithUnsupportedTPMOrCPU' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
 & 'reg' 'add' 'HKLM\zSOFTWARE\Microsoft\Windows\CurrentVersion\OOBE' '/v' 'BypassNRO' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+if ($IgnoreSecBoot) {
+    Write-Host "IgnoreSecBoot set: flagging image to enable testsigning/nointegritychecks on first boot..."
+    & 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'IgnoreSecBootBootRes' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+}
 Write-Host "Disabling Sponsored Apps:"
 & 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'OemPreInstalledAppsEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
 & 'reg' 'add' 'HKLM\zNTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager' '/v' 'PreInstalledAppsEnabled' '/t' 'REG_DWORD' '/d' '0' '/f' | Out-Null
@@ -796,6 +801,20 @@ Write-Host "Cleaning up image..."
 dism.exe /Image:$ScratchDisk\scratchdir /Cleanup-Image /StartComponentCleanup /ResetBase
 Write-Host "Cleanup complete."
 Write-Host ' '
+
+# Verify the component store isn't corrupt before we capture it.
+# /AnalyzeComponentStore is online-only (running OS) and only reports size/cleanup
+# recommendations, not a healthy/unhealthy verdict - /ScanHealth is the offline-capable
+# corruption check with an actual pass/fail result worth aborting the build on.
+Write-Host "Verifying component store health before capture..."
+$healthCheck = Repair-WindowsImage -Path $ScratchDisk\scratchdir -ScanHealth
+if ($healthCheck.ImageHealthState -ne 'Healthy') {
+    Write-Error "Component store health check failed (state: $($healthCheck.ImageHealthState)). Aborting build - image was NOT captured."
+    Dismount-WindowsImage -Path $ScratchDisk\scratchdir -Discard | Out-Null
+    exit 1
+}
+Write-Host "Component store is healthy."
+
 Write-Host "Unmounting image..."
 Dismount-WindowsImage -Path $ScratchDisk\scratchdir -Save
 Write-Host "Exporting image..."
@@ -828,6 +847,9 @@ Write-Host "Bypassing system requirements(on the setup image)..."
 & 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassStorageCheck' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
 & 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'BypassTPMCheck' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
 & 'reg' 'add' 'HKLM\zSYSTEM\Setup\MoSetup' '/v' 'AllowUpgradesWithUnsupportedTPMOrCPU' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+if ($IgnoreSecBoot) {
+    & 'reg' 'add' 'HKLM\zSYSTEM\Setup\LabConfig' '/v' 'IgnoreSecBootBootRes' '/t' 'REG_DWORD' '/d' '1' '/f' | Out-Null
+}
 Write-Host "Tweaking complete! Unmounting Registry..."
 $regKey.Close()
 reg unload HKLM\zCOMPONENTS | Out-Null