feat(vm): add --gui/--nogui to vm new --start, default headless

Mirror the `job` flag on the manual lifecycle: `vm new --start` was
hardcoded headless; add --gui/--nogui (default --nogui) so a clone can be
booted into the Workstation GUI window for interactive debugging. The
start banner reflects the mode.

Also update the runbook: §4.1 shows the --gui variant, and §3 notes that
the burnin-dummy build.sh is a ~30s fake build writing dist/build-info.txt
so the examples exercise the full pipeline.

docs/RUNBOOK-PhaseC.md

@@ -179,6 +179,10 @@ waits for the guest, runs the build, collects artifacts, and destroys the
 clone. It is exactly what the runner invokes on each push, and you can run it
 by hand too.
 
+The examples use `Simone/burnin-dummy`, whose `build.sh` simulates a real build
+(sleeps ~30 s, then writes `dist/build-info.txt`) — so the run exercises the
+full clone → build → artifact-collect → destroy path end to end.
+
 ```bash
 ci job \
   --job-id manual-$(date +%s) \
@@ -246,6 +250,19 @@ ci vm new \
   --start                          # prints the clone's VMX path on stdout
 ```
 
+`--start` boots the clone headless. To watch it in the Workstation GUI instead,
+add `--gui` (needs an X display — see [§4.7](#47-open-a-vm-in-the-workstation-gui)):
+
+```bash
+ci vm new \
+  --template /var/lib/ci/templates/LinuxBuild2404/LinuxBuild2404.vmx \
+  --snapshot BaseClean-Linux \
+  --clone-base-dir /var/lib/ci/build-vms \
+  --job-id dbg-1 \
+  --guest-os linux \
+  --start --gui
+```
+
 ### 4.2 Wait until reachable
 
 Prints the guest IP once ready. Use `--ip-address` to skip polling, or