feat(job): add --gui/--nogui flag, default headless

The Phase-2 VM start was hardcoded to headless. Expose a --gui/--nogui
toggle (default --nogui, preserving current behaviour); --gui starts the
clone with the Workstation GUI window (needs an X display, see §4.7). The
phase banner now reflects the chosen mode.

docs/RUNBOOK-PhaseC.md

@@ -201,7 +201,9 @@ default `--snapshot-name` is `BaseClean`, so Linux jobs must pass
   `--skip-artifact`, `--xvfb` (Linux GUI builds),
   `--extra-env-json '{"KEY":"VALUE"}'`
 - **VM**: `--guest-cpu N`, `--guest-memory-mb N`, `--template-path`,
-  `--snapshot-name`, `--ready-timeout`
+  `--snapshot-name`, `--ready-timeout`, `--gui` / `--nogui` (default `--nogui`,
+  headless; `--gui` opens the Workstation window and needs an X display —
+  see [§4.7](#47-open-a-vm-in-the-workstation-gui))
 - **Auth**: `--gitea-credential-target` (private repos)
 
 > For a zero-config end-to-end check, prefer `smoke run` ([§7](#7-phase-c-testing))