Windows: create a warm/golden AMI from the imported one to skip Sysprep first-boot on every launch #98

Problem

The AMI produced by spawn image import (EC2 Image Builder import-disk-image)
pays the full Windows Sysprep Specialize + OOBE first-boot cost on EVERY
launch — observed ~20 min on t3.large and still several+ min on m7i.xlarge
("Getting ready" splash). The bottleneck is the OOBE/specialize work, not just
instance CPU, so it can't be fixed by sizing up. Every spawn launch of the
imported AMI is therefore slow.

Idea (golden/warm AMI)

Launch the imported AMI once, let it finish first-boot setup (+ SSM agent +
spored + AWS drivers all settled), then create a NEW AMI from that running
instance. The second ("warm") AMI skips the import/OOBE tax and boots like a
normal AMI.

spawn already has the building block: spawn ami create <instance> (sibling
of the ami delete/ami snapshots added in #83). So the flow becomes:
image import (one-time, slow) → launch → spawn ami create → launch the warm
AMI thereafter (fast).

Design question: generalize or not?

• Non-generalized warm AMI boots straight to ready (fastest), but all
  instances share one machine SID — fine for spawn's ephemeral throwaway
  workers, not for domain-join/fleets.
• Sysprep-generalized warm AMI re-specializes on launch (still much faster
  than import, safe for fleets).

Probably: default to non-generalized for spawn's single-ephemeral model, with an
option to generalize. Possibly fold a --warm/post-import step into the import
flow so spawn image import can optionally produce the warm AMI automatically
(launch → wait-ready → ami create → terminate the seed).

Acceptance

• A documented (ideally one-command) path from the imported AMI to a warm AMI.
• Launching the warm AMI reaches usable state in ~normal Windows boot time, not
  import-OOBE time.

Refs #83, #95.