Add Windows raw disk support and image inspection

[Fx64b]

Summary

This PR adds proper Windows support for raw disk writes and implements image inspection to warn users when burning non-bootable images. The changes enable Brenner to safely write to physical drives on Windows by locking and dismounting volumes, and provide early feedback when an image cannot boot from a raw byte-for-byte copy.

Key Changes

• Windows raw disk handling (cmd/rawdisk_windows.go): Implements volume locking and dismounting via FSCTL_LOCK_VOLUME and FSCTL_DISMOUNT_VOLUME before writing to physical drives. This is essential because Windows blocks direct writes to sectors belonging to mounted volumes. The implementation:

  • Detects Windows raw device paths (\\.\PhysicalDriveN)
  • Locks all drive-lettered volumes on the target disk
  • Holds locks until verification completes
  • Checks for Administrator privileges

• Image inspection (internal/flash/inspect.go, internal/flash/inspect_test.go): New Inspect() function analyzes image headers to detect:

  • MBR boot signature and partition entries
  • GPT headers
  • ISO9660 primary volume descriptors
  • Provides BootableRaw() and WindowsInstaller() helper methods

• Pre-write warnings (cmd/exec.go): Added warnIfRawWriteWontBoot() to alert users before burning images that cannot boot from raw copies (e.g., Windows installer ISOs). Warnings are shown in both interactive and CLI modes.

• Improved verification (cmd/exec.go, internal/flash/writer.go):

  • Hash the image during write (via io.TeeReader) to avoid re-reading the source
  • Compare SHA-256 digests instead of byte-for-byte comparison
  • Added dropCache() on Linux to evict pages before verification, ensuring the readback actually hits the physical medium

• Better write coalescing (internal/flash/writer.go): Use io.ReadFull() instead of single Read() calls to handle short reads from pipes and tee chains, ensuring full-sized aligned writes required by Windows raw disk handles.

• Linux writeback tuning (cmd/devicewriter_linux.go): Enhanced dirty page cache management by waiting on writeback windows to keep the page cache bounded and prevent stalls during final fsync.

• Platform-specific stubs (cmd/rawdisk_other.go, cmd/dropcache_other.go, cmd/dropcache_linux.go): Build-tagged implementations for non-Windows platforms.

Notable Implementation Details

• Volume locks are held in a deferred release function until all verification is complete, preventing the filesystem stack from accessing the drive during the critical write+verify window
• Image inspection is best-effort and skipped in elevated child processes to avoid duplicate warnings
• The verification flow now never requires a second pass over the source image, improving performance for large ISOs
• Windows Administrator check uses process token elevation detection rather than relying on os.Stat() which cannot handle raw device paths

https://claude.ai/code/session_01RYHBqMpwXrHodFDVWD7FQJ