Automatically spawning a clean Ubuntu 22.10 installation in Qemu?

After having manually set up an Ubuntu 22.10

Installation

sudo apt install spice-vdagent # To allow copy paste into QEMU Ubuntu
sudo apt-get install qemu-kvm
cd ~/Downloads

Then one can manually download the latest Ubuntu 22.10 release from Ubuntu.com and store it into ~/Downloads/ubuntu.img. And proceed with:

qemu-img create ubuntu.img 20G
qemu-system-x86_64 -hda ubuntu.img -boot d -cdrom ~/Downloads/ubuntu-22.04.1-desktop-amd64.iso -m 640

Followed by manually clicking on the Ubuntu clean installation setup. After completing the manual installation, it asks "Remove installation medium and restart". One can close the VM and restart Ubuntu with:

Run

qemu-system-x86_64 --enable-kvm -m 4096 -machine smm=off -boot order=d \
  ubuntu22_1.img -smp 4 \
  -chardev qemu-vdagent,id=ch1,name=vdagent,clipboard=on \
  -device virtio-serial-pci \
  -device virtserialport,chardev=ch1,id=ch1,name=com.redhat.spice.0

Preparation within Ubuntu

Once the Ubuntu is booted, one can capture the keyboard with:

Ctrl+Left_alt+G

and update the machine with:

Ctrl+Alt+T
sudo apt update -y && sudo apt upgrade -y
sudo apt install spice-vdagent # To allow copy paste into QEMU Ubuntu

Issues

1. The download of the latest Ubuntu 22.10 image/iso is not automated.
2. The main issue is that the installation of Ubuntu itself, on the clean Ubuntu image/iso is not automated.
3. The updating and spice installation (to support copy paste to host) within the clean Ubuntu installation is not automated.

Question

How could one give someone a bash script/few commands that automatically give them a clean and updated Qemu installation of Ubuntu 22.10 (from scratch), with username: example_username and password: example_password?

Note

I am aware that I could just share my image that is updated and configured with that username and password. There are two issues with that: I don't consistently have a bandwidth from which they can download that image within reasonable time, and then they have to trust me. I would prefer they just rely on the script (that they can verify) and on the Ubuntu servers/releases.