Standardize go:generate for controller mocks + CI drift validation

Start by inspecting the listed controller packages, internal/windows/mock, internal/gcs/mock, and cmd/containerd-shim-lcow-v2/service for existing mock generation directives. Read .github/workflows/ci.yml and CONTRIBUTING.md, then run go generate ./... to identify the generated-file diff. Done means every listed package has a test-file directive, a fresh clone stays clean, CI detects drift, and the regeneration workflow is documented.

Background

Per @rawahars's review on #2647: the go:generate directive should reside in the test file, and we should validate generated mocks in CI.

Goals

1. Add a //go:generate directive (in a TEST file) for each controller that has mocks.
2. Add CI validation that runs go generate ./... and fails if there is any diff against the committed mock files. This catches mock drift when interfaces change but mocks are not regenerated.

Affected packages

• internal/controller/device/scsi/
• internal/controller/device/plan9/
• internal/controller/device/vpci/
• internal/controller/network/
• internal/controller/vm/
• internal/windows/ (mock at internal/windows/mock/)
• internal/gcs/ (GuestDefinedCapabilities mock at internal/gcs/mock/)
• cmd/containerd-shim-lcow-v2/service/

Future controllers should follow the same convention.

Suggested CI step

Extend an existing lint job in .github/workflows/ci.yml:

- name: Verify generated mocks are up to date
  run: |
    go generate ./...
    git diff --exit-code -- '*/mocks/*.go' '*/mock/*.go'

Run on windows-latest so build tags resolve correctly.

Acceptance criteria

• Each listed package has a //go:generate directive in a test file
• go generate ./... produces no diff against committed mocks on a fresh clone
• CI fails if a contributor changes an interface without regenerating
• CONTRIBUTING.md (or equivalent) documents the regeneration workflow

Notes

Discussed in #2647 (review on internal/controller/network/network_lcow.go).