Own experimental wired bridge setup and recovery in the launcher

[btsouth]

On top of #231, add an explicit disposable-lab launcher option that owns TAP preparation, Npcap forwarding and recovery. Run embedded helper code in a separate elevated broker. Keep QEMU unelevated, preserve private NAT services and forwards, and retain failed recovery in a protected journal. Drivers remain a separate manual installation.

Validation:

• Devbox Go race tests, vet and Windows cross-build pass.
• 457 focused checks pass in native PowerShell 5.1 and PowerShell Core. CI passes.
• The real candidate broker passes Windows VM DHCP/DNS, direct TCP, private services and loopback forwarding. TCP payloads of 1 byte, 1 MiB and 2 MiB return unchanged.
• Independent-peer IPv4/IPv6 bulk TCP, unchanged guest Ethernet MAC, raw EtherType exchange and broadcast/multicast pass.
• Duplicate setup, replacement identity refusal, repeated cleanup, QEMU exit, actual launcher-process exit and link-loss recovery pass.
• Permission cancellation and unexpected broker termination have focused tests.

Related to #166. This is an experimental lab option. Normal guest migration, Settings, physical Ethernet, Secure Boot/HVCI and broader Windows acceptance remain open. NAT and existing forwarding remain the defaults.