feat(transport): add cancellable Windows named pipes

[jlongster]

Summary

• Implement full-duplex byte-mode named pipes using direct windows-sys 0.61.2 bindings, protected current-user SID ACLs, remote rejection, exclusive first-instance binding, and non-impersonating clients.
• Poll overlapped accepts; replenish the listening instance before handing off each connection. Keep namespace ownership during stop/registration cleanup.
• Use per-operation OVERLAPPED/events with cancellation and completion reaping before releasing buffers; bound kernel I/O to 64 KiB chunks and connects to five seconds.
• Separate final-frame delivery from cancellation: retain the pipe for client close with a cancellable two-second deadline, never fake half-close or use FlushFileBuffers.
• Add six basic native Windows transport tests, without enabling the Windows daemon entrypoint yet.

Verification

• Local Linux formatting, locked Clippy all targets/features with warnings denied, and all 49 tests passed.
• Windows Rust/FFI code plus unit tests passed metadata-only cross-target Clippy in an uncommitted external harness. Full Linux-to-MSVC Ghostty build is unavailable without Windows SDK headers; this is NOT native runtime evidence.
• Draft until actual Windows x64/ARM64 CI validates the pipe tests. Subsequent stacked task T3 remains gated on that evidence.

Stack

master -> windows-transport (#13) -> windows-pipes (this PR) -> windows-daemon (next).
No merges. Current exclusive-owner/handoff semantics and protocol 7 are unchanged. Windows TerminalClient/CLI parity remains out of scope.

Corrected native/safety gate (3ebd4a5)

• Fixed OVERLAPPED retained-pointer provenance with the narrow production Retained allocation helper; raw-only access during pending I/O and reclamation after reaping.
• Windows: x64 and ARM64 each passed 25 library (including 6 real pipe tests), 5 effects, and 1 retained-pointer test, plus standalone25 rerun.
• Core: Linux50, macOS45, Miri5 callback +1 retained-pointer test under each borrow model; formatting/Clippy passed.
• Prior functional green at3f69078 was not the final safety gate. The corrected head above is the T3 base.