Install fails, SSH broken, blocks future updates

The first update for Windows 11 24H2 was a hat trick of dysfunction. First, it fails to install with error 0x800736b3, getting stuck at 40% or rolling back endlessly. Second, it breaks OpenSSH — the sshd service refuses to start with Error 1067 because Microsoft changed folder permissions that OpenSSH didn’t expect. Third, and most impressively, if you installed Windows from USB media with this update baked in, it permanently blocks all future updates from installing. Microsoft’s fix for the update that blocks updates? Install a different update. Which you can’t. Because updates are blocked.