[hanthor]

The VM host assumes identical target/scratch capacities and has no way to bind a smaller profile to the image and helper that proved it. This change validates separate helper minimums and prepares an explicit experiment selector bound to the exact immutable image reference and signed runtime-manifest SHA256.

Legacy minimumDiskBytes still applies to both disks. Explicit minimums must occur together, and any legacy fallback must be conservative. Missing/null/invalid bounds, duplicate keys, unsupported versions, insufficient space and overflow fail before disk creation.

Production remains at 40 GiB target + 40 GiB scratch + 8 GiB Windows reserve. The approved experiment registry is empty and the build-time experiment ID defaults to empty. A wrong image, changed runtime, unknown ID or incompatible helper is rejected; lower helper minimums alone never reduce the profile. Selected capacities and their profile/runtime identity are recorded durably, with matching generated DTOs.

Validation: Go race suite; Windows cross-compilation; native Windows parser/admission evidence; exact-boundary and one-byte-short tests; malformed contract and identity rejection tests; actual child writes before low-space cancellation while its lease is retained through reap. Removing admission, swapping bounds, or removing image binding makes the corresponding tests fail.

The experiment plan and read-only fixture inventory are included. The 32/16 GiB control and separate image-specific 32/8 candidate need guest provisioning, desktop/persistence, physical-capacity and Windows evidence. No profile is activated by this PR.

Stacked on #418. Existing signed archives remain unchanged. No new Windows VM writer starts until guest measurements pass and cluster storage supports the trial above its 26 GiB guard.

[hanthor]

Superseded: the VM disk profile commits were restacked on trial/vm-first-current-candidate (f5275bc and earlier), which is now carried to main by #495.