nvx-rs: keep a Windows launch's checked images guarded when its launcher ends before OpenVMM opens them #780

Problem

On Windows, a prepared launch (nvx::host::sandbox::PreparedLaunch, #752) names each checked image
by its final path, and OpenVMM opens the images by path. Until OpenVMM has opened them, only the
launcher's checked files hold those paths in place: the distro layer's handle, which denies writing
and deleting the layer, and the scratch image's guard, which denies deleting and renaming it. A
launcher that ends in that window, as when it crashes or is killed between OpenVMM's start and its
open of the images, closes them, and a replacement at either final path then reaches OpenVMM
unchecked.

On Linux, OpenVMM inherits the checked descriptors and opens them as /proc/self/fd/N, so it uses
the checked objects whatever happens to the launcher. #752 already keeps the scratch image's claim
with OpenVMM on Windows, through an inherited claim handle open for writing, but that handle shares
deleting: it does not hold the scratch image's path, so a sandbox bound to a replacement could claim
the replacement before OpenVMM opens it.

The CLI's start never commits such a launch: its journal stays in the sandbox's store, and the
sandbox's next transition ends its VMM through supervisor::reattach; until then, the VM runs the
replaced image. run, which keeps no journal, leaves its OpenVMM running until it exits.

Constraints

The checked handoff of #622 holds the Windows guards until authenticated Ready, or until a failed
launch is torn down, and releases them after authenticated Ready.

Options

1. OpenVMM also inherits the distro layer's handle and the scratch image's guard, through the
   supervisor's handle list, so that they last until it has opened the images even if the launcher
   ends. At authenticated Ready, the launcher closes OpenVMM's copies with DuplicateHandle and
   DUPLICATE_CLOSE_SOURCE, for example through a new PreparedLaunch::release(&Process), so that
   the guards are still released after Ready. A launch that is dropped without that release keeps
   them until OpenVMM exits.
2. On Windows, the supervisor starts OpenVMM in a kill-on-close job that the launcher holds until
   the launch commits (Starting::commit, Launched::detach), so that OpenVMM does not outlive a
   launcher that ends before Ready. This changes the supervisor's process lifetime on Windows only.

Acceptance

• A launcher that ends after starting OpenVMM and before OpenVMM opens the images: a replacement of
  the distro layer or of the scratch image at its final path fails, or OpenVMM never opens it.
• The guards are still released after authenticated Ready, or after a failed launch's teardown.
• a_vmm_keeps_the_scratch_images_claim_once_its_launcher_is_gone (nvx-rs/tests/checked_handoff.rs)
  also replaces both images after the launcher's checked files are closed and before the VMM opens
  them, and requires the checked objects to be used.

Follow-up of #752 (#622, A4 PR 3), from
#752 (comment).