Wait for the Windows VM RDP service before connecting

[qybaihe]

Summary

• keep the current-start container log check as the boot precondition
• after that message appears, poll the forwarded 127.0.0.1:3389 TCP listener before returning from up_wait
• retain the existing two-minute bound and report whether boot or RDP readiness timed out
• keep guest credentials out of the privileged probe and never launch FreeRDP as root

This closes the interval where dockurr/windows has logged Windows started successfully but the guest RDP service is not listening yet.

Fixes #9515

Testing

• test/shell.d/windows-vm-readiness-test.sh
• test/shell.d/windows-vm-test.sh
• test/shell.d/windows-vm-compose-test.sh
• test/shell.d/windows-vm-mount-boundary-test.sh
• ./test/cli
• bash -n bin/omarchy-windows-vm test/shell.d/windows-vm-readiness-test.sh
• git diff --check

All runtime and CLI tests passed in the ARM Linux Omarchy VM. The readiness test covers delayed boot reporting, delayed RDP listening, an already-running container, and a bounded RDP timeout.