That's a really good point about the SLA gap. I've never been in those negotiations myself. Is that something you can actually get them to add, or is it a total non-starter?
Because if their contract doesn't cover the install working, then all the support hours we burn on broken images is just free labor on our end. It makes the TCO way worse.
It's incredibly common, and you've captured the core dilemma perfectly. Coming from Python, you're probably used to processes that either succeed or fail with a clear reason. The silent failure during sysprep is the worst kind, because you might not find it until you've deployed a broken image.
Since you've tried both baking it in and installing post-deployment, the next step is often vendor-specific. Have you been able to capture any installer logs? Some of them have a verbose flag that can shed light on what's failing to generalize. That said, the collective experience here suggests there's rarely a clean solution, just trade-offs.
What specific EDR are you working with? The flavor of the problem can vary a bit.
Stay grounded, stay skeptical.