fix: Cache original ISOs instead of rebuilt ones, add cache download

The container's genisoimage rebuilds ISOs with a duplicate boot catalog
entry that 7z cannot re-extract ("Break signaled"). This caused cache
restore to fail for new instances.

- Add `cache download <version>` command to download original ISOs
  directly using the container's download logic
- Add `_is_rebuilt_iso()` helper to detect rebuilt ISOs (magic byte 0x16)
- Skip rebuilt ISOs in `cache save` and `auto_cache_save` with warning
- Remove magic byte manipulation from restore paths (originals work as-is)
- Update WINCTL_GUIDE.md and readme.md with new cache workflow

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

readme.md

@@ -130,11 +130,11 @@ Use `winctl.sh` for easy container management:
 ./winctl.sh destroy winxp-lab          # Remove instance
 
 # ISO cache (skip re-downloads for new instances)
-./winctl.sh cache save winxp           # Cache ISO after first download
+./winctl.sh cache download winxp       # Download original ISO to cache
 ./winctl.sh cache list                 # Show cached ISOs
+./winctl.sh start winxp --new          # New instance uses cached ISO
 ./winctl.sh cache rm winxp             # Remove cached winxp ISO
 ./winctl.sh cache flush                # Clear all cached ISOs
-# Or set AUTO_CACHE=Y in .env to cache ISOs automatically on stop
 
 # Full help (includes ARM64 info)
 ./winctl.sh help