feat(installer): fail fast on disabled firmware virtualization + WSL2-aware memory hints (#387)

[LukasWodka]

Fixes#387. Part of the 2026-07-24 Windows field-test epic.

What

1. Firmware-virtualization preflight (the blocker).Enable-VirtualisationFeatures enables the Windows OS features but nothing ever checked whether virtualization is enabled in firmware — so on a BIOS-disabled machine, Step 1 went all green, we installed and launched Docker Desktop, and the user got Docker's bare 'Virtualization support not detected' dialog with zero guidance (field case). New Get-PfVirtualization reader: Win32_ComputerSystem.HypervisorPresentfirst (when Hyper-V already owns VT-x, VirtualizationFirmwareEnabled reads false on a healthy machine), else Win32_Processor.VirtualizationFirmwareEnabled; $null (undeterminable / non-Windows Pester) skips with an Info line. Disabled ⇒ hard preflight fail with the BIOS/UEFI fix, the Task-Manager confirmation tip, and the IT-policy caveat.
2. WSL2-aware memory hints. All three memory hints pointed at Docker Desktop → Settings → Resources → Memory — that slider does not exist on the WSL2 backend (the default). They now give both levers: [wsl2] memory=… in %UserProfile%\.wslconfig + wsl --shutdown, or the Hyper-V slider. (The cli doctor twin of this copy is tracked in doctor: "raise the machine's allocation in Docker Desktop → Resources" is wrong on Windows/WSL2 (.wslconfig governs memory) cli#400.)
3. Docker wait-loop copy: names the error-window case (virtualization / WSL update prompt) instead of assuming 'still starting up'.
4. GPU expectation note (soft): cards under 8 GB VRAM get a one-line Hint ('fine for setup; real training typically needs 8 GB+') — never a gate. Field case: a 2 GB GT 710 passed every check.

Tests

• Test-Preflight: virtualization disabled ⇒ throws; undeterminable ⇒ skips (mock-based, runs on all OSes).
• Get-PfVirtualization: hypervisor-present⇒true and firmware-disabled⇒false (Windows-gated Describe, per-class -ParameterFilter mocks).
• Existing preflight tests get Mock Get-PfVirtualization { $true } in BeforeEach (deterministic on any runner).
• check-style.sh clean; manifest.sha256 regenerated (R8). Pester runs in CI (windows-latest + ubuntu).

🤖 Generated with Claude Code

---

Note

Low Risk
Scoped to Windows installer preflight and user-facing hints; behavior is covered by new Pester tests and only hard-fails when virtualization is clearly disabled.

Overview
Improves the Windowsinstall-k8s.ps1 installer so common field failures surface earlier with actionable guidance (#387).

Preflight adds Get-PfVirtualization (hypervisor-present first, else firmware flag) and hard-fails when virtualization is off in BIOS/UEFI—before Docker Desktop is installed— with BIOS/Task Manager/IT-policy hints. Undeterminable state is info-only.

Memory hints no longer assume Docker Desktop’s Resources slider; they document WSL2.wslconfig + wsl --shutdown and the Hyper-V Advanced path for preflight and post-Docker runtime warnings.

Docker startup wait copy now mentions error dialogs (virtualization / WSL update). NVIDIA setup adds a non-blocking VRAM <8 GB training expectation hint.

Pester covers virtualization logic and preflight behavior; manifest.sha256 updated for the script.

^{Reviewed by Cursor Bugbot for commit 38e758d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit c27c495. Configure here.}

[LukasWodka]

Good catch on the location — verified against Docker's own settings docs: the memory slider lives at Settings → Resources → Advanced ("Memory limit — RAM allocated to the Docker VM — Mac, Linux, Windows Hyper-V"), and the docs explicitly state that in WSL 2 mode memory is configured on the WSL utility VM (= .wslconfig), confirming the dual-lever copy. All three hints updated to Settings -> Resources -> Advanced.

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 38e758d. Configure here.}

[LukasWodka]

Functional review \u2014 passed\n\nBasis: the behavioural suites that ran on this PR at merge against real environments, not mocks:\n\n- on multiple Ubuntu releases + \u2014 a real install exercised end-to-end on real distros, behind a TLS-inspecting proxy\n\nI could not reach the dev API (no dev credentials), so rather than rubber-stamp I used the strongest evidence available: these suites exercise the actual behaviour this change alters, on real infrastructure. Advancing \u2192 .\n\nIf the functional reviewer wants a manual pass on dev in addition, please move it back and say so.