[rrvsh]

Summary

• define zagreus as a Nix-managed Q35/OVMF Windows VM using its dedicated physical NVMe disk directly
• reject VM startup when the Windows disk or any partition is mounted or held by another block device
• remove the Linux NTFS automount and host Samba share so Windows remains the routine owner of its filesystem
• bridge Nemesis's wired interface through br0, preserving the host's 10.10.0.11 address while giving zagreus its own LAN address
• add a compact VirtIO tools CD, QEMU guest-agent channel, Intel Bluetooth USB passthrough, FreeRDP audio launcher, and CIFS tooling
• replace the unrestricted top-bar reboot command with a narrow helper that checks VM and disk ownership before setting the Windows one-shot boot entry
• keep VNC as a firmware and recovery console, with RDP as the normal desktop path

Validation

• nix develop --accept-flake-config -c just check-nix
• git diff --check
• rebuilt and activated Nemesis from the branch
• booted Windows repeatedly through Q35/OVMF from the direct physical disk and shut it down cleanly
• verified QEMU runs as qemu-libvirtd and opens the physical disk writable only while the VM runs
• verified the libvirt start hook rejects startup while the Windows EFI partition is mounted read-only
• verified br0 retains Nemesis's physical MAC and 10.10.0.11/24 DHCP address across a NetworkManager restart
• verified gateway, DNS, internet, SSH, and Tailscale connectivity after bridge cutover
• verified zagreus joins the LAN as 10.10.0.96 with its fixed VM MAC
• verified VNC listens on 0.0.0.0:5900 and Windows RDP is reachable on 10.10.0.96:3389
• verified QEMU attaches the configured Bluetooth USB device as hostdev0
• verified the native-reboot helper refuses while zagreus is running and does not set an EFI one-shot variable

Guest-side VirtIO installation and the stopped-state native-reboot checks remain pending.