Fix macOS verification and device classification, hide internal Windows disks

[justanotherariel]

Description

Stacked on #83. Three platform bug fixes, one commit each:

• macOS verification always failed for images that aren't a 64 MiB multiple: dd reads whole blocks, so the device checksum included stale bytes past the image end. Verification now hashes exactly the image length.
• macOS classified SSDs as SD cards: the check matched "sd" as a substring, which "ssd" contains — e.g. a "Samsung Portable SSD T7" got the SD-card type. "SD" now has to appear as its own word (SDHC/SDXC/microSD included); regression tests added.
• Windows enumeration listed internal disks: non-removable (non-USB/SD/MMC) disks are now skipped during enumeration, matching Linux and macOS. (Ported from the pending windows-skip-nonremovable diff.)

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Refactoring (no functional changes)
• CI/CD changes

Related Issues

Stacked on #83 (part of the #14 stack).

Testing

• Unit tests added/updated (SD-classification regression tests: portable SSD is not an SD card, SDXC is)
• E2E tests added/updated
• Manually tested on macOS
• Manually tested on Windows
• Manually tested on Linux

cargo test -p hai-core --features mock passes on Linux; the macOS/Windows changes compile-check in CI. The macOS verify fix should get a real-hardware flash+verify before release.

Screenshots

N/A — no UI changes.

Checklist

• My code follows the project's code style
• I have run cargo fmt and npm run lint
• I have added tests for my changes
• All new and existing tests pass
• I have updated documentation if needed
• My commits follow conventional commit format

DO NOT MERGE. After reviewing, merge #14 to merge all directly