Run Windows MicroVM live oracles on a cloud

## Gap Epic 10020 ("Implement microVM on Windows and MacOS") merged the Windows backend (PR #6998) but no Windows MicroVM has ever booted live. Task 10058 was blocked twice: Org B's GitHub connection needs reconnecting, and `win-t8703` reports `wsl_no_kvm` (operator declined both fixes, "Not now"). The AC13 probe never ran, so `WINDOWS_NESTED_MICROVM` stays `False` at `apps/api/app/instance_types.py:68` on no evidence, and cloud Windows MicroVM is limited to metal types untested. Neither blocker applies to a cloud Windows node in the GMind org (MicroVM already allowed there; `gmind-microvm-1` runs tasks). The AWS door is the CP's own connection; the operator login is `org/console/dev-login` on https://app.dev.jaah.ai. ## Work (console only, as the operator; fixes allowed, each with a unit test) 1. P3 probe: allow-list m8i.large in the console, launch a Windows node on it in GMind through the AWS door, mark it MicroVM, read `kvm`/`microvm_prereq`, boot one VM at 1 vCPU / 2 GiB. Boots → set `WINDOWS_NESTED_MICROVM = True` citing the evidence in its docstring; fails → keep False, record the `wsl_no_kvm` sentence shown, and use m7i.metal-24xl for step 2. 2. On the capable node: AC1, AC2(c)(d), AC3, AC4, AC5, AC6 (incl. node's own IP and 169.254.169.254 refused), AC7, AC9, AC10, AC11, AC12 from Task 10058's body, verbatim. 3. AC13 refusal half: launching with MicroVM on an incapable type → readable refusal. 4. Boot-to-runner latency vs `gmind-microvm-1`; record why if > 2×. 5. Terminate the cloud node(s) through the console at the end. ## Acceptance Each AC above passes as written in Task 10058, with a screenshot or VM record cited in the report. Out of scope: `win-t8703` and Org B (blocked by operator decision); Mac oracles (Task 10061, closed by operator); new features; any Linux runtime change. Done means: - Probe outcome recorded and `WINDOWS_NESTED_MICROVM` set per evidence (PR merged via merge lane, Jaah Deploy green) — or, if unchanged, the report cites the observed refusal. - Every listed AC cited pass/fail with evidence; each failure fixed in this task's PR or filed. - `./dc check full` green if any code changed (cite GATE_RESULT).