Add Windows hypervisor primitives

[sjmiller609]

summary

• add direct-kernel and UEFI boot modes with raw and qcow2 disks
• support Secure Boot OVMF and per-instance swtpm lifecycle on standard QEMU
• advertise and validate UEFI/TPM requirements through runtime capabilities
• manage QEMU and swtpm through one cleanup stack while preserving required socket ordering
• expose software TPM output through the instance logs API
• document firmware, TPM ownership, restart, and cleanup semantics in the hypervisor READMEs

targeted tests

• go test ./lib/hypervisor/qemu ./lib/hypervisor ./lib/paths ./lib/instances ./cmd/api/api -run ... -count=1

Long-running KVM and full CI suites were not run for this review pass.

---

Note

Medium Risk
Touches VM boot, firmware, and TPM process lifecycle on QEMU, including CI KVM integration. Existing Linux direct-boot paths stay default but mis-validation could reject or mis-start guests.

Overview
Adds hypervisor-level UEFI boot, qcow2 disks, and software TPM 2.0 so standard QEMU (q35) can run Windows-style firmware guests without hard-coding backend names.

VMConfig now carries BootMode, firmware (immutable code + per-instance NVRAM), TPM socket/state, and disk format. Empty values keep today’s direct-kernel + raw-disk behavior. QEMU starts swtpm first, then QEMU, on one cleanup stack; fork path rewriting covers firmware and TPM files. Other backends (cloud-hypervisor, firecracker, vz, qemu-microvm) reject UEFI/TPM/qcow2.

Exposes source=swtpm on instance logs and installs OVMF/swtpm in CI for a dedicated Windows-config integration test.

^{Reviewed by Cursor Bugbot for commit 6b63aca. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

-->

✱ stlc build

✅ go code · compare

Your SDK build was successful.

generate ✅ → bootstrap ✅ → format ✅

116 files generated at b4712d2 (pushed)

go get github.com/kernel/hypeman-go-staging@b4712d2cabd5b5d61b076f7f8d6346b760ec95d1

✅ python code · compare

Your SDK build was successful.

generate ✅ → bootstrap ✅ → format ✅

230 files generated at 1d0ddeb (pushed)

✅ typescript code · compare

Your SDK build was successful.

generate ✅ → bootstrap ✅ → format ✅

138 files generated at 023adca (pushed)

Diagnostics: ❗ 0 new / 1 total error, 💡 0 new / 5 total note

Level	Code	Message	Targets

Build metadata

Build	bd_76BL5tnQ-tidal-sheen
Timestamp	2026-08-20T23:45:35.109Z
stlc	8413509
Spec hash	ddbd3be87ae7
Config hash	55e15f6f4434

---

This comment is auto-generated by stlc and is kept up to date as you push.
If you push new commits, re-run this workflow to update this comment.
Last updated: 2026-08-20 23:45:59 UTC

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 32eb71a. Configure here.}