Build the Windows domain and its endpoints on Saruman #265

Split out of #101.

ADR-0007 gives Saruman "a small Windows domain, realistic endpoints" as the
thing the rest of the estate exists to defend and instrument. It is the
component every other one is pointed at: Wazuh has nothing to read without it,
Velociraptor has nothing to hunt on, and
ADR-0014's
whole placement argument is that the techniques worth detecting — LLMNR and
NBNS poisoning, ARP spoofing, rogue DHCP, mitm6, WPAD — are layer 2 and only
reach a domain sharing their broadcast domain.

So this is the load-bearing piece of #101, and the one with the least written
down about it.

Worth deciding before starting

• How small is small. A DC and two endpoints is enough to poison; it is not
  enough to have realistic authentication traffic, tiered admin, or anything to
  laterally move toward. The right answer is bounded by spindles, not by
  taste — see below.
• Licensing and where the media comes from. Evaluation media expires, and
  an estate that has to be rebuilt every 180 days is one that will not be
  rebuilt.
• Guests take addresses on VLAN 30. The pool is .100–.200, statics live
  below .100, and Saruman at .110 is already the estate's one in-pool
  static. Domain members taking leases is fine; the DC is not a lease.
• Time. Kerberos fails domain-wide five minutes after the DC drifts, and
  ADR-0014 records that as the specific quiet failure a port allowlist would
  have caused. Whatever the DC syncs from, it is worth writing down.
• It is not in scope for backups here. Whether this is snapshot-and-revert
  like ifrit's range (ADR-0017) or a defended asset that PBS protects is a
  real question and belongs with the PBS issue.

The constraint

ADR-0007: "128 GB and 48 threads against a single mirrored pair of 7.2K disks.
The fleet is sized against spindles, not RAM." A domain controller, endpoints,
Wazuh's indexer, Velociraptor, PBS and the lab observability stack all land on
the same two spindles. Nothing else in #101 is likely to be what runs out.