For others facing a similar situation, I very strongly recommend starting here instead of DIY. :-)
> You have to create a god damn scheduled task to do Windows Updates over WinRM.
Aha. That must be why I could never get updates working with Packer/WinRM. It would take a very long time to do a huge amount of work then end up never quite finishing properly.
> And it takes ages for Powershell to realise the task is running, and polling the status of the job is a PITA.
OK, so not really a proper solution then. Oh well.
Took me days to automate Windows 2012 with Packer. Ugh