Add Win11 24H2/25H2 support + guard against silent wrong-version media

[javifly]

Summary

Adds Windows 11 24H2 (26100) and 25H2 (26200) choices, plus a catalog sanity check
that prevents a class of silent failures where the wrong Windows version gets built.

The bug this prevents

MCT builds whatever the catalog lists, ignoring the script's VER. Reusing the 24H2 catalog
for 25H2 (same servicing branch) therefore produces 24H2 media silently - the 24H2 cab
only lists 26100 builds. Two alternative sources also fail, documented so others don't repeat
the trip:

• Download Center 25H2 products.xml (id=108396) uses Sha256; MCT selfhost expects
  Sha1 -> 0x80070490 - 0x20018
• catalog fwlink 2156292 serves a cab frozen 2025-06-16 (26100-only), inconsistent across
  CDN nodes

Changes

• :choice-18 24H2 (26100.4349), :choice-19 25H2 (26200.6584)
• Catalog sanity check: after expanding, verify the catalog lists the requested VER;
  abort with a clear error instead of building the wrong version. This is the part worth
  landing regardless of anything else - it makes catalog drift loud instead of silent.
• Enhanced 24H2/25H2 hardware bypass (HwReqChk / LabConfig)

Testing

Auto ISO verified end to end on an unsupported Intel i7-7700K (Kaby Lake), es-ES: resulting
media confirmed 10.0.26200.6584 via dism /Get-WimInfo.

Note on the 25H2 catalog

25H2 has no working Microsoft catalog source (see above). In my fork I ship a small pinned,
hash-verified catalog cab in utils\ to solve this. I've kept that out of this PR's core to
respect the "Microsoft-hosted links only" design - happy to discuss how you'd prefer to
source the 25H2 catalog, or you can take just the sanity check + 24H2 for now.