Add Windows snapshots and forks

[sjmiller609]

summary

• enable Windows standby, restore, stopped snapshots, and forks
• preserve disk, Secure Boot NVRAM, TPM state, and QEMU configuration for same-instance restores
• assign fork identity according to memory-restore versus cold-boot semantics
• require forkable Windows images to declare bitlocker=disabled
• guard captured VioSock CIDs and rotate them on cold starts
• reduce final Windows KVM coverage to one comprehensive guest/network/standby/memory-fork lifecycle scenario plus one stopped-fork scenario
• document snapshot identity, TPM, VioSock, and BitLocker decisions in the instance README

targeted tests

• Windows image-policy, fork-identity, and hypervisor-config unit tests
• final lifecycle and stopped-fork integration test compilation/skip paths

Long-running KVM and full CI suites were not run for this review pass.