wip: wcow: option to run builds in hyperv isolation

[profnandaa]

Add an option to run builds in hyper-v isolation mode for Windows images.

WIP Checklist:

• Test with basic image runs (works ok)
• Test with bind and cache mounts (works ok)
• Test with CNI capability (this will not work, needs to be documentated)
• Discuss which flags to use to expose this, --isolated like in ctr?

Fixes #5682

---

Basic Test

FROM mcr.microsoft.com/windows/nanoserver:ltsc2022

ENV BUILDKIT_HYPERV_ISOLATED=1

RUN ping -n 30 localhost >nul

When the build is at the RUN stage, on a different terminal, try to run:

> Get-Process ping

# should get this error, since ping is not running on the host
# it's hyper-v isolated:
# Get-Process: Cannot find a process with the name "ping"...

Now try to build the same image with ENV BUILDKIT_HYPERV_ISOLATED=0 or without the env variable,
should get something like:

> Get-Process ping

 NPM(K)    PM(M)      WS(M)     CPU(s)      Id  SI ProcessName
 ------    -----      -----     ------      --  -- -----------
      6     0.93       4.21       0.00   25220  32 PING

[riverar]

Looks like this boiled down to adding a flag, nice.

I can't generate binaries on my dev machine to test this (happy to try it if you supply some or have a friendlier Windows dev workflow).

Agree with your suggestion that we add a --isolated to match ctr but am not strongly attached to it. It should be Dockerfile agnostic, however.

[profnandaa]

@riverar -- you can get the binaries from the test-os/build stage "Upload Artifacts" here - https://github.com/moby/buildkit/actions/runs/13385668839/artifacts/2607353633

[riverar]

@profnandaa No issues so far, works as expected.