Windows: add a quick-start build-and-run script separate from full validation

[coneilen]

Is your feature request related to a problem?
For a new contributor, the only documented route from a clean clone to a running Windows app goes through validate.ps1 -Task windows-shell and -Task packaging. Those runs include long live UI Automation and tray tests, and real scheduled-task install tests. A failing or flaky live gate blocks people who only want to build and run. No script launches a local build correctly, either. Doing it by hand needs the daemon started first, because a fresh support directory lacks .graphcode-rendezvous.secret (see the related issue). It also needs the first-run onboarding dialog dismissed and GRAPHCODE_SUPPORT_DIR set to avoid touching the real profile.

Describe the solution you'd like
Add a script, for example Tools\windows\dev.ps1, with:

• -Build: bootstrap if needed, stage the Swift products, build the shell (ReleaseSafe) and zmx, and assemble a runnable bin layout under .build.
• -Run: launch graphcoded.exe, then graphcode-windows.exe, with GRAPHCODE_SUPPORT_DIR pointed at a per-checkout sandbox under .build. Offer -RealProfile to opt out.
• -Stop: stop only processes whose executable path is inside this checkout.
• A clear printout of artifact paths and of what was and wasn't validated.

Keep validate.ps1 as the contributor and CI gate, and link the new script from graphcode-windows/README.md.

Describe alternatives you've considered
Documenting the manual steps only. They're fiddly and easy to get wrong; this session hit a silent daemon crash and stray files in the real profile.

Additional context
Needs a test under Tools/windows/Tests and the AGENTS.md PR evidence.

[coneilen]

Status audit — 2026-10-01

Classification: deferred, with no implementation present. This is contributor tooling, not a product-runtime defect. Recommendation: keep open. Confidence: high.

There is still no Tools/windows/dev.ps1 or equivalent checkout-scoped build/run/stop entrypoint. The nearest accepted work, #568, is intentionally not such a script: PreviewCore.Qualification.ps1 states that it neither installs, launches, authenticates, drives UI, nor manages processes/tasks. #569 is planning only.

Remaining acceptance criteria: implement a pinned-toolchain checkout build; assemble a runnable .build layout and report exact artifacts; run daemon/shell with an owned support sandbox by default; stop only processes belonging to this checkout; distinguish built from validated; add focused PowerShell tests/docs; and demonstrate a real build/run/stop cycle. It must coordinate with #555 rather than hide fresh-directory startup by pre-seeding state.

Preview priority: P2 contributor enablement; not a controlled prebuilt-package blocker.

[coneilen]

Implementation is active in PR #585 at exact head e5c2772f5608e915525f94faf855a4c07e752132. The checkout-scoped Tools\windows\dev.ps1 and 3-case behavioral contract are implemented; exact-head CI is still running. The issue stays open until the stacked #552 lane completes a real repository-pinned build/run/stop cycle, proves owned cleanup, and #585 can truthfully change from Part of #557 to Fixes #557 before stack landing.

[coneilen]

The required real repository-pinned cycle now passes on PR #585 exact head 834827edc84433af3df2604b0a8e5fd8a863eb25. Exact bootstrap pins completed in owned roots; incremental build reported BUILD_STATUS=BUILT with daemon/CLI/shell/zmx artifacts; run used owned support/LOCALAPPDATA/TEMP with daemon starting before shell; stop removed run.json and left zero checkout-owned daemon/shell/zmx processes; the default %USERPROFILE%\.graphcode snapshot remained byte-for-byte unchanged. No native UI, full validation, or package qualification is claimed. PR #585 is being updated to Fixes #557 and remains open until exact-head CI plus the stacked #552 docs layer land.