Replace ErrNotImplemented stubs with working Windows implementations:
- setupSignals: signal.Notify for os.Interrupt/os.Kill
- newServer: ttrpc.NewServer passthrough
- subreaper: no-op (not needed on Windows)
- serveListener: named pipe via go-winio, TTRPC_SOCKET env fallback
- reap: wait on ctx.Done (Windows auto-cleans child processes)
- handleExitSignals: listen for os.Interrupt, call cancel()
- openLog: return os.Stderr (no FIFO on Windows)

These implementations were proven in the working nerdbox demo.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Derek McGowan <derek@mcg.dev>

The openLog() stub on Windows returned os.Stderr, so shim logs
(including VM console output from nerdbox) were never delivered to
containerd's log aggregation. The reader side (openShimLog) already
connects to a named pipe:

  \.\pipe\containerd-shim-{namespace}-{id}-log

See https://github.com/containerd/containerd/blob/6667c769ecf6/core/runtime/v2/shim_windows.go#L76

but the writer side never created it.

Implement openLog() to create the matching named pipe via
winio.ListenPipe and return a pipeLogWriter that:
- Always writes to os.Stderr (so logs work even without containerd)
- Also writes to the pipe once containerd connects

Errors creating or accepting the pipe are non-fatal: openLog falls back
to os.Stderr so the shim still starts.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Derek McGowan <derek@mcg.dev>

Replace pipeLogWriter with a stderr redirect so that ALL writes to
os.Stderr are captured by the log pipe, not just logrus output.

The previous pipeLogWriter approach set logrus's output to a writer
that fanned out to stderr and the named pipe. This missed anything
written directly to os.Stderr, such as VM console output
(io.Copy(os.Stderr, consoleReader)) and native library traces (e.g.
krun DLL debug output).

The new approach mirrors what Unix does with dup2: replace os.Stderr
with the write end of an anonymous pipe, update the process-wide
STD_ERROR_HANDLE, and copy from the read end to both the original
stderr and the named pipe connection. This captures all stderr output
without requiring callers to route through logrus.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Derek McGowan <derek@mcg.dev>