Add guarded Windows command execution wrapper

[coneilen]

Summary

Adds a guarded Windows PowerShell wrapper for one script, with parse-before-launch, isolated child TEMP/TMP, no-clobber outputs, and exit/hash metadata. Registers its plain-PowerShell contract in the Windows runner.

Changes

• Adds Tools\windows\Invoke-AgentCommand.ps1 with string-array forwarding, redirectable streams 1–6 capture, per-run TEMP/TMP, and a derived .exit.json marker.
• Adds a plain PowerShell contract covering argument fidelity, output streams, no-clobber refusals, parse failure, environment restoration, and nonzero exits.
• Registers the six-case contract in ValidationRunner.Tests.ps1; existing Tools/windows/* classification selects Windows CI.

Test plan

RED: pwsh -NoProfile -File C:\Users\coneilen\AppData\Local\Temp\graphcode-agent-command-missing-api-d61cb32c7f4940c38456d0542d17a68b\Tools\windows\Tests\Invoke-AgentCommand.Tests.ps1 -> exit 1; MISSING-API control: wrapper path absent in test-only tree; The term 'C:\Users\coneilen\AppData\Local\Temp\graphcode-agent-command-missing-api-d61cb32c7f4940c38456d0542d17a68b\Tools\windows\Invoke-AgentCommand.ps1' is not recognized as a name of a cmdlet, function, script file, or executable program.
GREEN: pwsh -NoProfile -File Tools\windows\Tests\Invoke-AgentCommand.Tests.ps1 -> exit 0; PASS; executed=6; cases=argument-stream-marker,zero-arguments,existing-console,existing-marker,parse-failure,child-nonzero
REGRESSION: pwsh -NoProfile -File Tools\windows\Tests\Invoke-AgentCommand.Tests.ps1 -> same GREEN run; exit 0; six cases passed, including argument fidelity and no-clobber/parse/nonzero negative controls

The RED result is MISSING-API only: the isolated test-only tree omitted the wrapper after implementation was already written. It is not behavioral RED evidence and does not establish test-first development. GREEN and REGRESSION refer to the same one local invocation, run with process-only TEMP/TMP set to C:\Users\coneilen\AppData\Local\Temp\graphcode-agent-command-green-2b0e48ebe9c4454bac649de0c27af886\temp; its passing test scratch was removed.

The six cases are argument-stream-marker, zero-arguments (omitted and explicit-empty subcontrols), existing-console, existing-marker, parse-failure, and child-nonzero. The full ValidationRunner, make test, make check, and PR CI were not run locally; PR CI will exercise the registered runner contract.

Checklist

• I have read the Contributing Guidelines
• I have signed off my commits (git commit -s) per the DCO
• Tests pass locally (make test)
• Code follows the existing style (make check)
• I added the test/contract before the implementation and observed the intended RED failure

The test-first checkbox remains unchecked because the only RED control was MISSING-API after implementation existed; full local make test and make check were not run.