Initial commit: Packer + QEMU/KVM Windows 11 minimal VM

Fully unattended Windows 11 Pro build using Autounattend.xml, swtpm
for TPM 2.0 emulation, and VirtIO drivers. Five PowerShell provisioners
strip bloatware, telemetry, unused services, and apply performance tuning
for a resource-constrained host. Output is a compressed QCOW2 image.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

build.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# Orchestrates swtpm (software TPM 2.0) and runs the Packer build.
+# swtpm must be running before QEMU starts; this script handles that lifecycle.
+set -euo pipefail
+
+VAR_FILE="${1:-variables.pkrvars.hcl}"
+
+if [[ ! -f "$VAR_FILE" ]]; then
+    echo "ERROR: $VAR_FILE not found. Copy variables.pkrvars.hcl.example and fill it in." >&2
+    exit 1
+fi
+
+SWTPM_DIR="$(mktemp -d --tmpdir lite-win-swtpm.XXXXXX)"
+SWTPM_SOCK="${SWTPM_DIR}/swtpm.sock"
+SWTPM_PID="${SWTPM_DIR}/swtpm.pid"
+
+cleanup() {
+    if [[ -f "$SWTPM_PID" ]]; then
+        kill "$(cat "$SWTPM_PID")" 2>/dev/null || true
+    fi
+    rm -rf "$SWTPM_DIR"
+}
+trap cleanup EXIT
+
+echo "==> Starting swtpm (TPM 2.0 emulator)..."
+swtpm socket \
+    --tpmstate "dir=${SWTPM_DIR}" \
+    --ctrl "type=unixio,path=${SWTPM_SOCK}" \
+    --pid "file=${SWTPM_PID}" \
+    --log level=1 \
+    --tpm2 \
+    --daemon
+
+# Give swtpm a moment to create the socket
+for i in $(seq 1 10); do
+    [[ -S "$SWTPM_SOCK" ]] && break
+    sleep 0.3
+done
+
+if [[ ! -S "$SWTPM_SOCK" ]]; then
+    echo "ERROR: swtpm socket not created at ${SWTPM_SOCK}" >&2
+    exit 1
+fi
+
+echo "==> swtpm ready at ${SWTPM_SOCK}"
+echo "==> Running Packer build..."
+
+packer build \
+    -var "swtpm_sock=${SWTPM_SOCK}" \
+    -var-file="${VAR_FILE}" \
+    .