dotfiles: Windows XP VM provisioning

dotfiles: Windows XP VM provisioning

setup-windows-xp.bat provisions the throwaway XP VM that the XP-toolset
builds get tested on: an SSH server, the two logon-policy fixes XP needs
before SSH password auth can work at all, and Python 3.4.4, the last
CPython that runs there.

It downloads nothing. XP's SChannel stops at TLS 1.0, so the VM cannot
reach python.org or sourceforge over HTTPS; the installers are staged on
the host into vendor-xp/ (gitignored) and the script prints the shopping
list when they are missing. Run from the normal account it stages itself
to C:\xp-setup and hands back the runas line, since a share mounted under
one account is invisible to the Administrator account.

Behaviour verified end to end against a stubbed environment rather than a
real XP box, which caught four bugs worth recording: shift renumbers %0,
so %~nx0 goes stale after option parsing; find.exe is shadowed by any unix
find on PATH and a probe write leaks "Access is denied" past 2>nul; and a
message string reaching echo via %~1 must contain no < > ( ) — carets do
not help once the quotes are gone, and a paren inside a nested if-block
closes the block early.

xp-fetch.py covers the other direction: CPython carries its own OpenSSL,
so the Python this installs is a TLS 1.2 client on a box where nothing
else is. cacert.pem comes with it because XP's root store cannot validate
a current certificate chain.

Known gap, recorded in the README: the OpenSSH 3.8.1p1 binary the manifest
asks for is no longer published on SourceForge.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TvpzKcPxN75rWPqGbSRyvJ