Add cc PC backend, browser VNC, RAM framebuffer and PE linking APIs

[Vbitz]

Add reusable infrastructure for running and displaying a caller-supplied VM: an in-process cc Linux/amd64 KVM backend, browser VNC, a RAM framebuffer protocol, and portable PE construction APIs.

• Implement BIOS interrupt services, IDE, planar VGA, PS/2 input, frame capture and bounded inspection behind the existing VMM interfaces. Disk inputs use the portable block interface and memory overlays.
• Implement RFB over byte channels, a WebSocket adapter and a self-contained JavaScript canvas client. The native -serve frontend accepts a VM returned by a caller's Starlark recipe.
• Define and decode the TRF1 RAM framebuffer protocol. Guest-specific drivers and their installation policy live with the consumer's image recipe.
• Link existing i386 ELF objects into PE32 images with imports, exports, relocations and explicit stdcall adapters; construct PE resource sections in memory. Renvo is unchanged.

NT 3.1 image construction, guest display/miniport sources, ABI declarations, registry setup, launch recipes and whole-guest smokes are in tinyrangex #67. This PR supplies the reusable pieces that those recipes consume; it does not provide an NT 3.1 image builder or boot recipe.

Validation in trex: focused cc/KVM, RAM framebuffer, PE linker/resource, RFB/WebSocket and JavaScript tests, including race checks. Consumer integration in TinyRangeX: stock-Renvo driver ABI smoke, fresh NT 3.1 Notepad/Security and Write smokes, and Firefox launch/typing. These establish one working consumer of the APIs, not general guest compatibility.

Current backend limits: Linux/amd64 KVM, one CPU and IDE disk, BIOS modes 03h/12h, relative PS/2 input. Guest driver sources and NT-specific operational guidance have been moved into TinyRangeX.

Dependency: cc #210, pinned at b42f4a0, for x86 KVM state and execution control. Merge cc #210, then this PR, then tinyrangex #67. No Renvo PR is required.

CI fixes: grant the Go job access to KVM so native backend tests execute; remove the redundant single-exit loop in cc. Full local Go tests, vet, build and all 153 Starlark tests pass.