PR #125: Harden Windows runtime node and one-command provisioning

[Atlas2005]

Summary

Hardens the QuantPilot Windows runtime node and provides a repeatable one-command provisioning workflow for the existing continuous-paper control center.

Scope

• Windows PowerShell 5.1-compatible bootstrap
• Secure DPAPI-backed runtime secrets
• Persistent PostgreSQL and Grafana services
• Runtime Doctor and lifecycle scripts
• Prefect 3 retry and scheduling compatibility
• Idempotent runtime configuration updates
• Windows CI coverage
• Windows-safe test paths

Runtime boundaries

• broker_provider=none
• No QMT adapter
• No PTrade adapter
• No broker login
• No broker credential handling
• No order submission
• DeepSeek live calls remain disabled
• XtQuant remains optional

Windows acceptance

Validated on the actual Windows runtime node using:

• Windows PowerShell 5.1
• Python 3.12.9
• Docker 29.3.1
• Docker Compose 5.1.1
• Prefect 3.7.8
• PostgreSQL 16
• Grafana 11.2.0

Results:

• Initial bootstrap: passed
• Runtime status twice: passed
• Two consecutive repeated bootstraps: passed
• Windows atomic replacement behavioral test: passed
• PostgreSQL reachable after retries
• Grafana reachable after retries
• Existing secrets and persistent volumes reused
• No repeated secret prompts
• Windows focused suites: 41 passed
• Production candidate suite: 11 passed
• Former Windows path failure: passed

Test results

• macOS full suite: 1647 passed, 2 skipped
• macOS runtime node: 14 passed, 1 skipped
• macOS continuous paper: 14 passed, 1 skipped
• macOS production candidate: 11 passed
• Windows focused suites: 41 passed
• git diff --check: passed

Windows issues found and fixed during acceptance

1. PowerShell $home collision with read-only $HOME
2. PowerShell $matches collision with automatic $Matches
3. Windows PowerShell 5.1 rejection of File.Replace(..., $null)
4. Test directory derived from invalid Windows filename characters

Final commit

06336414b9230f09c380799e55323015b2b9688f