feat(windows): add a security-first Windows 11 Preview port

[songconmaisaix31-design]

Summary

• add an explicit macOS/Windows platform boundary while preserving the existing macOS runtime
• add Windows-native path, process, listener, storage, picker, structured commandSpec, schema v2 migration, and explicit config import support
• add managed Windows lifecycle control built around CREATE_SUSPENDED, Job Objects, a private Named Pipe, signed receipts, exact runtime identity, and generation CAS
• add an unsigned reproducible PyInstaller onedir package, archive audit, fixture-owned package smoke tests, and cross-platform CI gates
• align the README, security notes, release checklist, API contracts, decisions, and test evidence with the Windows Preview/Alpha scope

Windows safety model

• Local Ops only controls process trees created by the exact Local Ops generation and verified through SID, PID creation time, Job membership, HMAC-signed receipts, and a private runtime directory.
• A port, PID, process name, cwd, parent PID, or command line is never treated as ownership proof.
• Windows external attach/kill and console restart remain disabled.
• Force stop is never automatic. It is available only after a graceful-stop timeout, a fresh state read, exact-generation verification, and a second explicit confirmation.
• Lifecycle tests only create and control isolated fixture/CI processes; they do not target existing user processes.

Validation

• Phase 5 implementation commit: 5daddece8a06d1fdd382d1814e58be7b777ceae4
• Accepted exact-implementation CI: https://github.com/songconmaisaix31-design/local-ops-windows/actions/runs/31780819809
• Current PR head: 7c665cf273ad35c298b8595398bb5b7fbc8193ae
• Current PR-head CI: https://github.com/songconmaisaix31-design/local-ops-windows/actions/runs/31786772469
• Windows lifecycle-gated discovery: 207 tests passed; the package smoke was run separately and passed 1/1.
• Common, macOS, Windows, frontend, HTTP hardening, Node lifecycle, package reproducibility, archive audit, and fixture-owned package smoke gates passed in the accepted and current-head CI evidence.

Current scope and limitations

This is a Windows 11 x64 Preview/Alpha engineering candidate, not a public Beta. Source mode targets Python 3.12; the packaged artifact is an unsigned development build. Windows 10, an independent clean machine without Python, Defender/SmartScreen acceptance, native picker and Windows Notification Center delivery, brand review, and signing/release decisions remain open gates.

Upstream context

Related to #1.

An existing Windows implementation is already under review in #2. This Draft PR offers a security-first alternative with a stricter process-ownership and fail-closed lifecycle model so maintainers can compare the tradeoffs. It is not intended to close #1 or supersede #2 without maintainer review.

Compatibility

The macOS standard-library runtime and existing user data remain supported. Windows-only runtime/build dependencies are isolated in dedicated requirement files, and schema v2 is additive: the legacy command field remains available while Windows execution requires a validated structured commandSpec.

[laogou717]

感谢你的贡献，安全优先的设计（Job Objects、签名回执、CREATE_SUSPENDED）和文档工作量都很可观。

说明一下维护立场：总控台由原作者个人维护，功能迭代以个人日常使用的实际需求为准，暂不承诺审阅或合入社区 PR（详见 README「维护说明」）。

你的移植已收录到 README 的「社区衍生版本」推荐列表。欢迎在你的仓库继续维护这个版本，并在 Discussions 提交说明或更新，我会同步更新推荐列表。