Summary

• allow brokered AWS target=windows windowsMode=wsl2 leases
• launch WSL2 leases on nested-virtualization-capable C8i/M8i/R8i families and set EC2 CpuOptions.NestedVirtualization=enabled
• add Windows bootstrap lifecycle for WSL feature enablement, required reboots, WSL kernel update, Ubuntu rootfs import, and Linux-side Crabbox toolchain setup

Verification

• go test ./internal/cli -run 'TestAWSUserDataWindows|TestValidateProviderTarget|TestApplyServerTypeFlagOverrides|TestApplyAWSRunInstanceTargetOptions|TestAWSLaunchCandidates|TestWSL2WrapsRemoteCommand|TestVersion|TestLoadConfigReadsTargetAndWindowsMode'
• npm test --prefix worker -- aws.test.ts config.test.ts
• go test ./...
• go vet ./...
• npm run format:check --prefix worker && npm run lint --prefix worker && npm run check --prefix worker && npm test --prefix worker && npm run build --prefix worker
• git diff --check

Live probe

• Built branch binary 0.5.1-local.aws-wsl2.
• bin/crabbox run --provider aws --target windows --windows-mode wsl2 --class standard --market spot --ttl 60m --idle-timeout 15m --timing-json --shell -- 'printf "aws_wsl2_managed_ok=1\n"; uname -a; cat /etc/os-release | head -5; git --version; rsync --version | head -1'
• Result: branch CLI now sends preferred_type=m8i.large, but the deployed Worker still returns unsupported target for brokered aws: windows. This PR needs the Worker deployed before the managed WSL2 path can be fully proven live.

Deploy note

This shell is not authenticated to Cloudflare Wrangler (wrangler whoami says to run wrangler login), so I could not deploy the broker from here.