Add OCI Windows machine images

[sjmiller609]

summary

• add OCI metadata and materialization for Windows base/persona machine images
• normalize raw, qcow2, VHD, and VHDX bases into immutable sparse raw disks
• canonicalize persona backing paths and reflink-clone writable per-instance qcow2 disks
• create per-instance OVMF/NVRAM and TPM state for Windows QEMU instances
• reject external disk references and pre-snapshot Windows lifecycle operations
• preserve existing Linux image and instance behavior

tests

• go test -run 'TestMaterializeRejectsExternalDiskReferences|TestMaterializeWindowsBaseFormats|TestMaterializeWindowsPersona|TestValidateWindows|TestRejectWindowsSnapshotLifecycle' -v ./lib/images ./lib/instances on deft
• CI=true HYPEMAN_WINDOWS_TEST_BASE=/ci/windows/base.raw HYPEMAN_WINDOWS_TEST_PERSONA=/ci/windows/persona.qcow2 go test -run TestMachineArtifactsPullFromOCI -v -timeout 20m ./lib/images on deft
• CI=true HYPEMAN_WINDOWS_TEST_PERSONA=/ci/windows/persona.qcow2 go test -run 'TestWindowsImagesIntegration|TestQEMUStandbyAndRestore' -v -timeout 20m ./lib/instances on deft

notes

• Windows instances remain Initializing until guest-agent readiness lands in the next phase.
• Image tag deletion now aborts if digest tag counting fails rather than deleting a tag with uncertain digest ownership.
• The manually prepared Windows fixtures are private and digest-pinned; no Windows media, generated disks, credentials, or licensing material is committed.