Sweep MicroVM policy and ADR register

## Epic requirement (verbatim) "Implement microVM on Windows and MacOS" (Task 10021 PRD ask #1, `in_scope`). Operator decisions that bind every child (verbatim from the PRD/Architecture): - D1 **Full parity** with Linux. Each session gets its own Linux guest kernel. The CP egress allowlist is enforced on the node. Control calls are vsock-bound (or an equivalent per-VM channel). No NodeLink inside the VM. No root in the guest. The disk is retained on `system_failed`. Console, sizing and placement UX are the same. - D2 **All three:** fleet runners, advisor chats and human console sessions. D3 **The Linux guest's set** of providers. D4 macOS = Apple Silicon, Windows = x64. D5 cloud Windows too. D7 same plan feature (`billing_plans.microvm_allowed` + `orgs.microvm_allowed_override`). - AD1 Windows = WSL2 + the existing Cloud Hypervisor/KVM runtime (Windows 10 refused). AD2 Mac guests arm64 only, no Rosetta. AD3 Windows test PC = `win-t8703`. AD5 probe m8i.large exactly; metal (m7i.metal-24xl) is the fallback. AD6 Mac oracles deferred until the Mac is enrolled on dev. AD7 AC2(a) live is dropped; unit tests map every `microvm_prereq` code to its sentence. **Quality bar (verbatim).** Every refusal shown to an operator is one plain sentence naming what is missing and how to fix it (`docs/standards/ui-copy-standards.md`). No generic 400, no stack trace, no Linux-specific wording on a Mac or Windows node. Boot-to-runner latency on Mac and Win is reported in the build's evidence. It is not gated, but it must not be degraded by more than 2× against a Linux MicroVM node of similar size without the Architect recording why. ## This child: C4 — policy & register sweep (Architecture §6 C4) Requirements this child serves (PRD §4, verbatim): - R8. Docs describe the present. `docs/policies/microvm-nodes.md`, ADR-0129 (including the per-OS boundary statement), ADR-0145 / `node_platform.py` docstring, `apps/jaahd/README.md` (MicroVM section) and the macOS/Windows packaging docs describe the new state. Facts are single-homed, and `python3 tools/check_context.py` passes. The full settled Architecture (Task 10022) and PRD (Task 10021) are the epic's prerequisite artifacts; read them with `task_read`/`artifact_read` when this body is shorter than you need. ### Approach (settled, realize it) - `docs/policies/microvm-nodes.md`: directive says each session runs in "its own VM under the node OS's hypervisor"; a per-OS table (Linux: Cloud Hypervisor/KVM; Windows: the same runtime in a WSL2 distro over `kvm-wsl2`; macOS: `jaah-vz` over Virtualization.framework, vsock-only egress, arm64 guests) **pointing at each home** (`microvm_mode.py` `PREREQ_SENTENCES`, `node_platform.py` `CAP_MICROVM`/`session_platform`, `instance_types.microvm_capable_for`, `microvm_bridge.py`, `apps/jaahd/vz/`) — never copying their values. - ADR-0129 (`docs/adrs/README.md`): decision line no longer "Linux/KVM only"; anti-patterns name "strong isolation"/"defence in depth" wording for any OS; the per-OS boundary paragraphs written by the runtime children stay, edited in place only for consistency and for what the Mac-verification child recorded (e.g. which token-share path held, R-b). - `apps/jaahd/README.md` MicroVM section: describes the three OS runtimes, pointing at their homes. - Living docs describe the present; no provenance prose. Acceptance criteria this child owns (PRD §5, verbatim): - AC16 — Docs describe the present (R8). Verify: `python3 tools/check_context.py` exits 0. `docs/policies/microvm-nodes.md` and ADR-0129 name the per-OS hypervisor and boundary, and no longer say "Linux/KVM only". The MicroVM capability appears in the `node_platform.py` capability story. Credentials & reach (Architect §8, verbatim rows): - AC15 gate, AC16, AC17 | Worktree only (`./dc check full`, `tools/check_context.py`, `tools/microvm_pins.py`) | **verified**: nothing beyond the worktree. Out of scope (BA, verbatim — do NOT touch): - Do **not** change Linux MicroVM behaviour, its pins, its egress default list (`apps/api/app/microvm_egress.py`) or its sizing defaults, beyond what is needed to add the OS dimension. - Do **not** change the static worktree pool or dynamic worktrees on any OS. - Do **not** add a new plan term or billing price (D7). - Do **not** mount NodeLinks inside a VM on any OS. - Do **not** add Multi-Node Hosts / co-located nodes (`vnode_host`), GitHub Actions runners or SDK-agent support to macOS or Windows hosts. - Do **not** support Intel Macs, Windows on ARM, or cloud-launched macOS nodes. - Do **not** relax the host-session (unmarked) capability table of ADR-0145. - Do **not** describe the boundary as stronger than each hypervisor gives ("strong isolation", "defence in depth" — ADR-0129 anti-pattern). - No new console page. Existing surfaces only (A4). - Operate and verify Jaah only through the console. No CLI, SQL or cloud-console workaround for live state (CLAUDE.md hard rule). Also do NOT touch: code. Docs only. Done means: - AC16 — `python3 tools/check_context.py` exits 0 (output cited); `grep -rn "Linux/KVM only\|every pin is x86_64" docs/ apps/jaahd/README.md packaging/` returns nothing; `docs/policies/microvm-nodes.md` and ADR-0129 each name the hypervisor for Linux, Windows and macOS and the per-OS boundary; the `node_platform.py` docstring names `CAP_MICROVM`. - Quality: no boundary sentence uses "strong", "stronger", "defence in depth" or "isolation guarantee"; every per-OS fact is a pointer to its code home, not a copied value (the reviewer reads the diff against this rule).