feat(vm): --disk-cache / --ephemeral switch (cache=unsafe for throwaway demo VMs)

[CMGS]

Context

qemu/launch.go currently hardcodes the macOS OS disk (MacHDD) to
cache=writeback,aio=io_uring,discard=unmap,detect-zeroes=unmap (commit f3d529d).
writeback is the correct safe default: it uses the host page cache to mask
qcow2-overlay + GCP persistent-disk latency and still honors guest fsync/flush.

Proposal

Make the disk cache mode selectable per VM so disposable demo/clone VMs can opt
into the faster cache=unsafe:

• --ephemeral — semantic alias -> cache=unsafe ("this VM is throwaway;
  prioritize speed; disk state may be lost on host/qemu crash").
• --disk-cache writeback|unsafe|none|directsync — explicit control, default writeback.

Why

cache=unsafe ignores the guest's flush/fsync, eliminating fsync-barrier stalls.
Big win for write-heavy bursts (first boot, app installs, clone warm-up, large
copies). Tradeoff: on host/qemu crash the qcow2 can be lost or corrupted, so it's
only acceptable for VMs whose disk state is disposable.

Scope

Mirror the --hugepages plumbing (commit 506fd64): qemu.Spec field + flag in
cmd/vm/commands.go, wired through record (persist for start), launch(),
and clone inheritance, plus a launch_test.go assertion. Default unchanged
(writeback) so existing behavior is preserved.

Notes

The biggest perceived-slowness wins already landed (Spotlight-off baked into the
image + writeback/io_uring on the drive), so this is incremental — most valuable
for batch / ephemeral demo workflows.