Add automatic guest routing and Settings for bridge labs

[btsouth]

Adds boot-only NetworkManager profiles matched to the LAN and private guest MACs. Compatible guests must establish separate routes and DNS before reporting ready. Failed startup stops the owned VM and recovers TAP before showing an error; paused VMs do not consume the startup timeout.

Settings imports an explicit disposable-lab plan, retains DHCP identities and recovers TAP before returning to NAT. Drivers remain a separate manual install. NAT and existing forwards remain the default. Backups and portable copies omit host adapter preferences.

Validation:

• Go race tests, vet, Windows build and CI pass; 205 guest tests pass.
• Native Windows settings save, cancellation, repeated recovery and process cleanup pass.
• The complete Refresh Windows guest pins for the networking candidate #234 factory guest passes headless Windows TCG DHCP, systemd-resolved DNS, private services and exact 2 MiB TCP with Windows and an independent virtual Ethernet peer. Private forwarding, shutdown and TAP recovery pass.
• Separate NetworkManager checks cover reconnect and single-NIC NAT with the user profile preserved.

Based on #232. Refs #166. Still draft pending normal WHPX/graphical launcher startup, persistent migration, physical Ethernet, Windows 10 and Secure Boot/HVCI acceptance. No merge or release is included.