Add Windows snapshots and forks

[sjmiller609]

summary

• enable Windows standby, restore, stopped snapshots, and forks
• preserve disk, Secure Boot NVRAM, TPM state, and QEMU configuration for same-instance restores
• assign fork identity according to memory-restore versus cold-boot semantics
• require forkable Windows images to declare bitlocker=disabled
• guard captured VioSock CIDs and rotate them on cold starts
• keep final Windows KVM coverage to one standby/memory-fork lifecycle scenario plus one stopped-fork scenario
• document snapshot identity, TPM, VioSock, and BitLocker decisions in the instance README

targeted tests

• Windows image-policy, fork-identity, and hypervisor-config unit tests
• dedicated standby/memory-fork and stopped-fork integration gates

Both dedicated Windows KVM gates and the full Linux, Darwin, and install suites pass. The final head also passed six consecutive full workflow runs without a hidden Windows-gate retry (runs 33095320830, 33096527026, 33097202925, 33100760941, 33104170468, and 33105225214).

---

Note

High Risk
Changes core Windows VM lifecycle (TPM, VioSock, fork/restore concurrency, and guest identity) and removes prior hard blocks on snapshot operations, so regressions could cause identity collisions or unsafe forks on BitLocker-protected images.

Overview
Windows standby, restore, snapshots, and forks are enabled end-to-end on QEMU, replacing the previous blanket rejection of snapshot lifecycle on windows/amd64. Same-instance standby/restore keeps disk, NVRAM, TPM, and memory together; forks split identity by path—stopped forks clear TPM, assign a new VioSock CID, and cold-boot; memory/standby forks keep captured TPM, VioSock, and NIC state until the child cold-starts, with serialized restore (windowsRestoreMu) and checks so two VMs cannot share a captured CID concurrently. Running sources require target_state=Stopped for forks; running standby snapshot forks need the source stopped first.

Fork admission requires image label io.hypeman.machine-image.bitlocker=disabled (parsed on create into WindowsBitLockerPolicy). After fork, RebindIdentity on the guest agent sets a new MachineGuid and records the instance ID; the manager calls it on start/restore when WindowsIdentityPending is set.

Guest API: new RebindIdentity RPC (proto, client helper with retries, Windows agent implementation).

CI: shared run-windows-integration-test.sh (isolated TMPDIR, QEMU/swtpm cleanup, retries) drives lifecycle, stopped-fork, and hypervisor gates; workflow cleanup includes swtpm and Windows test temp dirs. Integration coverage shifts from the old networking-heavy test to TestWindowsLifecycleIntegration and TestWindowsStoppedForkIntegration.

Docs: BitLocker label on Windows images; new docs/windows-snapshots.md; instances README section on fork identity. Minor test-harness fix: bridge names derived from subnet and safer stale route cleanup.

^{Reviewed by Cursor Bugbot for commit 5d22773. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 09ce3d1. Configure here.}