Add Windows quick-start build and run tooling

[coneilen]

Summary

Adds a checkout-scoped Windows contributor entrypoint that builds a runnable .build layout, launches the production daemon before the shell with owned sandbox roots, and stops only captured processes whose executable path and creation identity still match. Full validation remains a separate explicit task.

Fixes #557.

Changes

• add Tools\windows\dev.ps1 with composable -Build, -Run, and -Stop actions plus explicit -RealProfile opt-out
• reuse pinned bootstrap/environment, provider build, Swift staging, and ReleaseSafe Zig build mechanisms to publish .build\windows\dev\bin
• create fresh per-run GRAPHCODE_SUPPORT_DIR, LOCALAPPDATA, TEMP, and TMP roots without pre-seeding rendezvous state
• record exact executable paths and process creation times, then revalidate held process identities before stop; discover only run-prefixed zmx processes from the checkout layout
• report artifact paths and separate BUILD_STATUS, LAUNCH_STATUS, and VALIDATION_STATUS
• add focused behavioral coverage for runnable layout assembly, sandbox/startup ordering, successful owned stop, and PID identity mismatch refusal

Test plan

RED: pwsh -NoProfile -File Tools\windows\Tests\Dev.Tests.ps1 -> failed because nested build output contaminated the helper success pipeline
GREEN: pwsh -NoProfile -File Tools\windows\Tests\Dev.Tests.ps1 -> PASS with 4 behavioral cases executed
REGRESSION: pwsh ProviderPins.Tests.ps1 then TerminalGate.Tests.ps1 -List -> provider contracts passed and 4 gate cases were listed

Additional checks:

• pwsh -NoProfile -File Tools\windows\dev.ps1 -Stop -> parser/interface passed and reported no checkout-owned run without touching processes
• git diff --cached --check -> passed before commit
• exact base check for 6010b280c21dd56c72916e248e7bf534e241851a -> passed
• Invoke-Pester Tools\windows\Tests\ValidationIsolation.Tests.ps1 -> not usable in this host because installed Pester 3.4.0 rejects the repository's Should -Be syntax; all 4 cases failed before exercising assertions
• Tools\windows\bootstrap.ps1 -> completed in 2064.1s with owned roots and exact Zig 0.15.2/0.16.0, Winghostty 6286560d0aa3103e068b2b7afa81eac373d870c9, and zmx 785b3fd15dcafd1882b495c831a10f98c201b908
• pwsh -NoProfile -File Tools\windows\dev.ps1 -Build -> passed in 141.2s with BUILD_STATUS=BUILT, LAUNCH_STATUS=NOT_REQUESTED, VALIDATION_STATUS=NOT_RUN, and all four .build\windows\dev\bin executables reported
• pwsh -NoProfile -File Tools\windows\dev.ps1 -Run -> passed in 1.7s with run c0502662a7324b7cacbca91b0e991491; daemon PID 14228 started before shell PID 42384, both exact checkout-owned identities were alive, and support/LOCALAPPDATA/TEMP used the reported run sandbox
• pwsh -NoProfile -File Tools\windows\dev.ps1 -Stop -> passed in 0.8s; run.json was absent, captured identities were gone, zero checkout-owned daemon/shell/zmx processes remained, and the default %USERPROFILE%\.graphcode hash and metadata snapshot was identical
• no native UI interaction, accessibility qualification, packaging gate, or full validate.ps1 run is claimed

Checklist

• I have read the Contributing Guidelines
• I have signed off my commits (git commit -s) per the DCO
• Tests pass locally (make test) — not run because this Windows-only contributor tooling does not change the macOS product; focused Windows behavioral and provider contract checks passed
• Code follows the existing style (make check) — not run because this changes PowerShell only; parser checks and git diff --check passed
• I added the test/contract before the implementation and observed the intended RED failure