Add OCI Windows machine images

[sjmiller609]

summary

• add OCI metadata and materialization for launchable Windows machine images
• distinguish immutable windows-base artifacts from launchable windows-image artifacts
• normalize raw, qcow2, VHD, and VHDX bases into immutable sparse raw disks
• pin Windows images to digest-addressed bases and replace artifact-supplied backing paths
• reflink-clone writable per-instance qcow2 disks with private NVRAM and TPM state
• validate Windows requirements through hypervisor UEFI/TPM capabilities
• document image processing, launch defaults, and fixed disk sizing in library READMEs
• remove the redundant image-only Windows VM boot gate

targeted tests

• Windows machine-image parsing, validation, materialization, and OCI tests
• Windows create validation and hypervisor-config tests

Validated after rebasing onto main: Linux, Darwin, e2e install, Semgrep, Socket, and Windows machine-image CI gates pass.

---

Note

Medium Risk
Changes core image materialization (qemu-img, backing chains) and VM boot configuration (UEFI/TPM disks); mistakes could break launches or leave inconsistent cache dependencies, though Linux paths remain separate.

Overview
Adds bootable Windows desktop disks distributed as OCI images on windows/amd64, separate from non-bootable Windows container images. Artifacts use io.hypeman.machine-image.* labels for windows-base (immutable backing disk) and windows-image (launchable qcow2 delta with digest-pinned base, TPM 2.0, Secure Boot required).

The image manager materializes bases from raw/qcow2/VHD/VHDX into immutable sparse base.raw, copies Windows images to image.qcow2, and rebases them onto cache-owned bases (rejecting external backing paths, encryption, and unsafe disk features). Base deletion is blocked while any cached windows-image references the base digest, including cross-repository base refs.

Instance create for Windows skips Linux kernel/config-disk setup, applies higher defaults (8 GiB RAM, 4 vCPUs), reflone-clones the cached image to a writable per-instance qcow2 at fixed virtual size, and boots via UEFI + Secure Boot + TPM (OVMF templates and TPM state paths). Create validation rejects networking, volumes/GPU, hotplug, env/health checks, and mismatched overlay_size; snapshot/standby/fork paths are rejected until a later phase. Implicit host-platform image resolution no longer fast-paths cached Windows tags.

^{Reviewed by Cursor Bugbot for commit 56c51b4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

-->

✱ stlc build

✅ go code · compare

Your SDK build was successful.

generate ✅ → bootstrap ✅ → format ✅

116 files generated at 72751bb (pushed)

go get github.com/kernel/hypeman-go-staging@72751bb4fcb05519886a96eff977c12c9a40f8ee

✅ python code · compare

Your SDK build was successful.

generate ✅ → bootstrap ✅ → format ✅

230 files generated at b0465be (pushed)

✅ typescript code · compare

Your SDK build was successful.

generate ✅ → bootstrap ✅ → format ✅

138 files generated at fbe49da (pushed)

Diagnostics: ❗ 0 new / 1 total error, 💡 0 new / 5 total note

Level	Code	Message	Targets

Build metadata

Build	bd_76BHqpcQ-still-maze
Timestamp	2026-08-20T20:29:54.044Z
stlc	8413509
Spec hash	ddbd3be87ae7
Config hash	55e15f6f4434

---

This comment is auto-generated by stlc and is kept up to date as you push.
If you push new commits, re-run this workflow to update this comment.
Last updated: 2026-08-20 20:30:27 UTC

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2c43db6. Configure here.}