fix: make Guacamole fixture dual-stack and keep VM display awake

docs/testing-vm.md

@@ -91,6 +91,9 @@ self-signed HTTPS Guacamole gateway while retaining VRDE on Helium loopback and
 the reconnecting SSH watchdog/tunnel on a private Docker gateway. Follow its
 full lease/prepare/up/
 down/reset lifecycle; it is not an alternative to the native test controller.
+In public-bind mode the helper also owns a tracked IPv6-to-IPv4 `socat` forward
+when the browser hostname has an AAAA record; check `ipv6_forward=active` in
+`rdp-access status` before diagnosing a browser-side “Waiting for response”.
 
 ## Snapshots and reset contract
 
@@ -112,10 +115,14 @@ stateful run must:
 1. Acquire the run lease and verify the VM name, UUID, and snapshot UUID.
 2. Restore `baseline-clean-administrator` if the current state is not the baseline.
 3. Start headless and wait for `VMState=running` plus Guest Additions readiness.
-4. Run the bounded test, collect redacted artifacts, and close every Guest
+4. Apply the disposable display/sleep keepalive (`monitor-timeout`, standby,
+   and hibernate timers set to zero) so VirtualBox VRDE cannot expose a
+   zero-bpp framebuffer after Windows idle timeout. This is recorded as
+   `prepare-display-keepalive` and is reapplied after every snapshot restore.
+5. Run the bounded test, collect redacted artifacts, and close every Guest
    Control process that was opened by the run.
-5. Request a graceful guest shutdown and wait for `VMState=poweroff`.
-6. Restore `baseline-clean-administrator` again and leave the VM powered off.
+6. Request a graceful guest shutdown and wait for `VMState=poweroff`.
+7. Restore `baseline-clean-administrator` again and leave the VM powered off.
 
 Use `controlvm ... poweroff` only for a hung, disposable test; it can lose
 guest state. Never delete any clean snapshot, unregister the VM, or alter