vmix run command, virtio-drivers template, delay-oobe-run flag

CLI:
- `vmix run <qcow2>` boots image with QEMU (SDL if DISPLAY, snapshot mode)
- --generalize supports delay-oobe-run=true to defer OOBE + activation
  to first boot on real hardware (for physical disk deployments)

Templates:
- essentials.virtioDrivers: installs VirtIO drivers only (no guest agent)
  used in laptop bundle for network access during Office download
- generalize: delayOobeRun flag controls sysprep /shutdown vs /reboot
  delays OOBE, user creation and HWID activation to target device

Build:
- suppress XDG_RUNTIME_DIR and homeless-shelter warnings in SDL mode
- remove invalid ICH9-LMB global properties

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lib/images/windows/templates/default.nix

@@ -19,6 +19,7 @@ in rec {
     vcppRuntimes    = import ./essentials/vcpp-runtimes.nix args;
     bestPerformance      = import ./essentials/best-performance.nix args;
     clearFileAssociations = import ./essentials/clear-file-associations.nix args;
+    virtioDrivers   = import ./essentials/virtio-drivers.nix args;
   };
 
   # Applications
@@ -35,7 +36,7 @@ in rec {
   # Default file associations policy
   defaultApps = import ./default-apps.nix args;
 
-  # Generalize (sysprep + OOBE)
+  # Generalize (sysprep + OOBE). Pass seal=true for hardware deployment.
   generalize = import ./generalize.nix args;
 
   # Offline registry templates
@@ -59,10 +60,10 @@ in rec {
       reg.performanceTweaks
       apps.edgeWebview
       apps.thorium
-      apps.sandboxie
       apps.sevenZip
       apps.vlc
       apps.imageGlass
+      essentials.virtioDrivers # needed for network during Office download
       apps.office
     ];
   };