Move flash-target policy out of hai-core

[justanotherariel]

Description

Stacked on #81. hai-core's disk code becomes pure mechanism; policy lives at the app boundary.

• validate_device_path is removed from write_image; instead flash_image requires the target to be a device that list_devices() currently reports as removable (find_flash_target).
• Mock gating leaves device enumeration — the list_block_devices command already does that check.
• Unsupported target OSes fail with compile_error! instead of shipping untested runtime stubs.

Behavior changes to review: internal non-boot disks on Windows are no longer flashable (previously only PhysicalDrive0 was blocked), and hai_core::disk_writer::write_image writes to whatever it is given — callers own target selection.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Refactoring (no functional changes)
• CI/CD changes

Related Issues

Stacked on #81 (part of the #14 stack); base of #83.

Testing

• Unit tests added/updated (find_flash_target accept/reject cases; validation tests removed with the code they tested)
• E2E tests added/updated
• Manually tested on macOS
• Manually tested on Windows
• Manually tested on Linux

cargo test -p hai-core --features mock and cargo test -p hai-desktop pass on Linux.

Screenshots

N/A — no UI changes.

Checklist

• My code follows the project's code style
• I have run cargo fmt and npm run lint
• I have added tests for my changes
• All new and existing tests pass
• I have updated documentation if needed
• My commits follow conventional commit format

DO NOT MERGE. After reviewing, merge #14 to merge all directly