fix(windows): split bootstrap profiles

[jwmoss]

Summary

Splits managed Windows bootstrap generation into explicit core, desktop, and WSL2 profiles.

• Native Windows without --desktop now runs only the core Windows user/OpenSSH/Git/tar setup and writes the setup marker.
• Native Windows with --desktop keeps the TightVNC, per-user VNC startup, CrabboxUserVNC, auto-logon, and VNC readiness behavior.
• Windows WSL2 keeps the WSL optional feature, kernel update, rootfs import, and Linux crabbox-ready setup without writing Windows VNC/autologon artifacts.
• The Cloudflare Worker bootstrap generator now mirrors the CLI generator contract.
• AWS docs now describe TightVNC/autologon as optional --desktop behavior, not default native Windows behavior.

Improves #81 by tightening the Windows desktop vs WSL2 boundary that PR added for Azure. It also fixes the same WSL2/VNC boundary for AWS from #23 and keeps the AWS desktop VNC behavior from #14 isolated to desktop leases.

Implementation Notes

• internal/cli/bootstrap.go
  • windowsBootstrapPowerShell now composes a shared core script and selects one profile tail.
  • Added helpers for Windows host work root vs WSL Linux work root.
  • Moved WSL2 setup into windowsWSL2BootstrapPowerShell.
  • Moved TightVNC/autologon setup into windowsDesktopBootstrapPowerShell.
  • Added windowsCoreBootstrapFinalizePowerShell for no-desktop native Windows.
• internal/cli/aws_windows_bootstrap.go
  • Generalized the post-SSH bootstrap runner and made phase labels profile-specific.
  • VNC readiness is only checked for native Windows desktop.
• worker/src/bootstrap.ts
  • Mirrors the CLI bootstrap profile split for coordinator-created leases.
• Tests
  • Added Go and Worker assertions that core and WSL2 bootstraps exclude VNC/autologon artifacts.
• Docs
  • Updated AWS docs to describe TightVNC/autologon as optional --desktop behavior.

Validation

Local:

go vet ./...
go test ./...
go build -trimpath -o bin/crabbox ./cmd/crabbox
git diff --check
npm run format:check --prefix worker
npm run lint --prefix worker
npm run check --prefix worker
npm test --prefix worker
npm run build --prefix worker

Branch live integration, direct mode:

Provider	Profile	Type	Warmup	Result
AWS	Native core, no desktop/VNC	m7i.large	2m56.944s	aws-core-no-vnc-ok
AWS	Native desktop/VNC	m7i.large	3m52.877s	aws-desktop-vnc-ok
AWS	WSL2, no desktop/VNC	m8i.large	5m48.834s	aws-wsl2-no-vnc-ok
Azure	Native core, no desktop/VNC	Standard_D2ads_v6	4m50.301s	azure-core-no-vnc-ok
Azure	Native desktop/VNC	Standard_D2ads_v6	5m55.272s	azure-desktop-vnc-ok
Azure	WSL2, no desktop/VNC	Standard_D2ads_v6	8m34.526s	azure-wsl2-no-vnc-ok

Old-vs-new baseline, direct mode:

Provider	Profile	Upstream warmup	Branch warmup	Branch delta	Artifact result
AWS	Native core, no desktop	3m58.477s	2m56.944s	61.533s faster	Upstream created VNC artifacts; branch did not.
AWS	Native desktop/VNC	3m48.659s	3m52.877s	4.218s slower	Both created VNC artifacts and reached VNC readiness.
AWS	WSL2	6m53.604s	5m48.834s	64.770s faster	Upstream created Windows VNC files; branch did not.
Azure	Native core, no desktop	3m40.705s	4m50.301s	69.596s slower	Both were clean of VNC artifacts.
Azure	Native desktop/VNC	4m04.178s	5m55.272s	111.094s slower	Both created VNC artifacts and reached VNC readiness.
Azure	WSL2	7m28.962s	8m34.526s	65.564s slower	Upstream created Windows VNC files; branch did not.

AWS performance improvement from the fix:

• AWS native no-desktop now runs Windows core bootstrap instead of upstream's Windows desktop bootstrap.
• AWS native no-desktop improved from 3m58.477s to 2m56.944s, a 61.533s improvement in the live sample.
• AWS WSL2 improved from 6m53.604s to 5m48.834s, a 64.770s improvement in the live sample, while also removing unsupported Windows VNC files.

Cleanup:

• Stopped all six branch live validation leases.
• Stopped all six upstream baseline leases. The Azure WSL2 upstream release required live Azure resource cleanup because the old CLI tried a coordinator release path for that slug; post-cleanup Azure resource lookup by lease returned no rows.
• bin/crabbox list --provider aws --target windows returned no rows after cleanup.
• bin/crabbox list --provider azure --target windows returned no rows after cleanup.

Risk

• Coordinator mode was validated through the mirrored Worker generator tests and dry-run Worker build, not by deploying a live Worker preview.
• Fresh WSL2 hosts still require the expected Windows feature/kernel reboot loop; this PR isolates that behavior but does not remove it.