Summary

• configure AWS Windows OpenSSH to listen on Crabbox's configured SSH port plus fallback ports
• open matching Windows Firewall rules during desktop bootstrap
• preserve the discovered SSH port across AWS Windows bootstrap waits

cc @steipete

Notes

• Hetzner Windows is still intentionally unsupported in this provider path; the CLI fails before provisioning with provider=hetzner currently supports target=linux only; use provider=ssh for target=windows.

Verification

• go test ./internal/cli -run 'TestAWSUserDataWindowsProfile|TestAWSUserDataMacOSProfile|TestCloudInitUsesRetryingBootstrap|TestSSHPortCandidates'
• npm run format:check --prefix worker
• npm run lint --prefix worker
• npm run check --prefix worker
• npm test --prefix worker -- bootstrap.test.ts config.test.ts

Known local noise

• go test ./internal/cli hit existing flaky TestRunEventStreamWriterCapsOutputEvents: outputBytes=28672, want 65536.