fix(windows): harden the ABE payload injection lifecycle

[slimwang]

Summary

Make the Windows ABE injection lifecycle deterministic and tighten the memory
permissions used for the raw payload.

The spawned browser's primary thread now remains suspended for the entire
operation. Only the remote Bootstrap thread runs, so the injector no longer
needs a temporary --user-data-dir, a normal browser window, or a fixed 500 ms
startup delay.

What changed

• Keep the browser primary thread suspended until the process is terminated.
• Remove the temporary user-data directory and fixed resume/sleep sequence.
• Allocate the raw payload as RW, write it, switch it to RX with
  VirtualProtectEx, and call FlushInstructionCache before execution.
• Move diagnostics and key output into a standalone RW scratch allocation.
• Pass the scratch address and pre-resolved imports through a dedicated
  BootstrapParams block instead of patching the payload's DOS stub.
• Generate the C struct size and all six parameter offsets into Go constants.
• Add Windows tests for parameter encoding, alignment, bounds, and coverage.
• Update RFC-010 for the new lifecycle and memory layout.

The explicit cache flush follows the Windows API contract documented for
VirtualProtectEx
and
FlushInstructionCache.

Validation

• go test ./... with Go 1.26.2 on macOS arm64
• go test ./... with Go 1.20.14 on macOS arm64
• go vet ./...
• golangci-lint v2.10.0: 0 issues
• typos v1.49.0
• default, Linux amd64, and Windows amd64 builds
• Windows test packages compiled with Go 1.26.2 and Go 1.20.14
• make gen-layout-verify
• make payload-verify (75,776-byte payload; Bootstrap export present)
• make build-windows with abe_embed using Go 1.26.2 and Go 1.20.14

Windows test binaries and browser integration were not executed during this
macOS review.

Runtime validation supplied with the patch

The patch handoff reports Windows 10 execution against Chrome, Edge, CocCoc,
and Brave, including successful ABE extraction and no residual browser
processes. These results were not rerun as part of the validation above.

Checklist

• Pull request targets the main branch
• All CI checks pass
• Windows-specific tests are included and compile with Go 1.20.14
• RFC documentation is included
• go.mod remains at Go 1.20