Add opt-in native Windows onboarding for qualification

Part of #8178.

This task adds an explicit qualification-only onboarding path. It does not make MXC available through normal runtime selection or establish supported Windows installation.

## Outcome

A maintainer can deliberately attach to the accepted existing Windows OpenShell/MXC installation and run NemoClaw onboarding through injected provider contracts for an internal demonstration.

## Delivery state

Opt-in qualification onboarding.

## Dependencies

- Blocked by #10585.
- Can proceed in parallel with #10587 and #10588 after their issue numbers are assigned.
- Contributes to the protected E2E and activation gate.

## Deliverables

- Connect central provider-neutral onboarding to the qualified existing-installation composition.
- Persist exact provider, sandbox, workload, lifecycle, attachment, and artifact authority.
- Require an explicit maintainer or qualification invocation; do not add MXC to the production provider registry or ordinary CLI selection.
- Surface actionable preflight failures before OpenShell mutation.

## Acceptance evidence

- Allowed: an explicit qualified invocation on the accepted profile reaches create and readiness and persists the same provider identity.
- Denied: normal onboarding cannot select MXC; missing qualification, invalid receipt, or stale attachment authority fails before mutation.
- Ambiguous: resumed onboarding reconciles the persisted provider and sandbox rather than selecting a provider again.
- Failure or recovery: partial onboarding returns exact recovery and cleanup evidence without exposing credentials.

## Security and authority boundaries

- Central onboarding must remain provider-neutral and free of MXC identity branches.
- Provider identity must remain stable across resume and cleanup.
- No production credential may be required for the qualification-only path.

## Test plan

- Focused provider-neutral onboarding, persistence, resume, rejection, and architecture tests.
- Physical demo rehearsal against the already-qualified profile.

## Deferred scope

- General installer exposure, supported user onboarding, policy and inference completion, and activation.

## Stop conditions

- Stop if the invocation can be reached through ordinary runtime selection.
- Stop if product-visible CLI or installer behavior is required before maintainers accept that surface.

## Completion evidence

- Link the implementation PR, exact merged commit, focused tests, and physical demo rehearsal. One same-repository PR should close this issue.