fix: warn about WSL impact of disabling VBS

[iesllc2026]

Summary

Warns users that disabling Core Isolation/VBS may prevent WSL2 and Docker Desktop from starting, and fixes the VBS enable-state metadata.

Related to #1615.

Root cause and scope

The reported error occurs while HCS creates the WSL2 VM. Current Atlas sources do not modify the implicated vmcompute, VMBus, or storage virtualization components. Disabling VBS remains a plausible hardware-dependent trigger, but it is not proven to explain every ERROR_PATH_NOT_FOUND report.

This change therefore adds an evidence-backed warning and confirmation instead of introducing a speculative service, driver, optional-feature, or BCD repair.

Changes

• Label the Core Isolation option with its possible WSL2/Docker impact.
• Show the same warning from the shared VBS PowerShell path.
• Require confirmation before using the post-install Disable VBS command.
• Record the Enable VBS state as enabled (1) instead of disabled (0).

Validation

• Parsed playbook.conf successfully as XML.
• Parsed ConfigVBS.ps1 successfully with the PowerShell parser.
• Verified the warning occurs before registry mutation and /silent bypass remains available.
• Verified Disable VBS records 0 and Enable VBS records 1.
• Built the playbook successfully with local-build.ps1.
• Tested the generated APBX archive successfully and verified all four patched members.
• git diff --check upstream/main...HEAD passed.

Testing limitation

Runtime HCS behavior requires testing on supported Windows hardware with WSL2 or Docker Desktop. This PR does not claim to repair every possible cause of the reported HCS error.