Windows: official port -- UCRT static build, UTF-8 throughout, Low IL sandbox, ncurses TUI, installer; v0.6.0

Build
  * cross build switches to pkgsCross.ucrt64 (shell-win.nix); curl (Schannel),
    winpthreads and ncurses 6.6 are linked statically, so the release is
    cst-agent.exe + busybox.exe (busybox-w32 Unicode) with no extra DLLs
  * windres embeds a manifest with activeCodePage=UTF-8 and a version resource
  * ncurses 6.6 Windows console driver patches (mouse button state, A_DIM,
    wide-char declarations): scripts/patches/
  * scripts/bootstrap_msys2.sh builds the same release natively in MSYS2
    UCRT64; PR #1's MINGW64 notes now point there
  * vendor/tre-regex (musl's TRE) provides <regex.h> on MinGW

UTF-8
  * paths cross the system call boundary as UTF-16 (*W APIs); console code
    pages set to 65001 and restored on exit; files are read and written in
    binary mode
  * child output that is not valid UTF-8 is decoded from the console, OEM or
    ANSI system code page
  * read_file hides CR; edit_file, apply_patch and write_file keep CRLF line
    endings and a UTF-8 BOM

OS layer and processes
  * os_dir_* and cst_fnmatch replace the POSIX-only directory walks in
    subagent, plugins, skills, undo and fs_tools; realpath / path_under and
    symlink rejection work on Windows
  * every child goes through CreateProcessW with its own environment block
    inside a Job Object, so timeouts and Esc end the whole process tree

Sandbox (auto mode, "auto · lowil")
  * run_shell runs with a restricted Low integrity token; the workspace gets
    an inheritable Low label once, the sandbox TEMP is labeled Low, and the
    credentials file gets a no-read-up label
  * drive roots, the profile and system folders are never labeled
  * network commands still ask, since Low IL does not block the network;
    Access denied and MSYS2's 0xc0000142 offer a rerun outside the sandbox
  * /sandbox lists labeled folders, /sandbox reset-labels restores them

TUI
  * raster console fonts are switched to Consolas / NSimSun while running
  * the home logo falls back to text when the console font lacks U+2580
  * mouse drag copy goes to the Windows clipboard

Distribution
  * scripts/install_windows.ps1 installs a Gitea release into
    %LOCALAPPDATA%\Programs\cst-agent and adds it to the user PATH;
    cst-agent-update.cmd reruns it; scripts/release_windows.sh uploads the
    zip with the token taken from the environment
  * scripts/run_windows.bat is gone; docs/README-windows.md is rewritten

Tests
  * new test_lowil, test_win_utf8 and test_os_dir; tests made portable
    (cst_test_util.h)
  * scripts/win_test.sh and scripts/winvm/ run the suite on English and
    Chinese Windows Server VMs as Administrator, a standard user and a
    Chinese user name: 29/29 on all six

src/permissions.c

@@ -7,6 +7,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <strings.h>
 
 #include "cJSON.h"
 #include "cst_perms.h"
@@ -33,7 +34,7 @@ static void load(cst_perms_t *p) {
   while ((n = fread(tmp, 1, sizeof(tmp), fp)) > 0 && b.len < 256 * 1024)
     cst_buf_append(&b, tmp, n);
   fclose(fp);
-  cJSON *root = b.buf ? cJSON_Parse(b.buf) : NULL;
+  cJSON *root = b.buf ? cJSON_Parse(b.buf + cst_bom_len(b.buf, b.len)) : NULL;
   cst_buf_free(&b);
   const cJSON *it = NULL;
   cJSON_ArrayForEach(it, cJSON_GetObjectItemCaseSensitive(root, "tools")) {
@@ -222,6 +223,73 @@ void cst_perms_suggest_prefix(const char *cmd, char *out, size_t out_sz) {
     out[0] = 0;
 }
 
+/* --- network commands ------------------------------------------------------ */
+
+static int net_word_eq(const char *w, size_t n, const char *name) {
+  size_t k = strlen(name);
+  if (n == k + 4 && strncasecmp(w + k, ".exe", 4) == 0)
+    n = k;
+  return n == k && strncasecmp(w, name, k) == 0;
+}
+
+int cst_shell_uses_network(const char *cmd) {
+  static const char *const TOOLS[] = {
+      "curl",   "wget",     "ssh",   "scp",     "sftp",    "rsync",
+      "ftp",    "tftp",     "telnet", "nc",     "ncat",    "netcat",
+      "socat",  "npx",      "invoke-webrequest", "iwr",    "invoke-restmethod",
+      "irm",    "start-bitstransfer", "bitsadmin", "certutil"};
+  /* tool + sub-command that downloads or uploads */
+  static const char *const PAIRS[][2] = {
+      {"git", "clone"},     {"git", "fetch"},     {"git", "pull"},
+      {"git", "push"},      {"git", "ls-remote"}, {"git", "submodule"},
+      {"npm", "install"},   {"npm", "i"},         {"npm", "ci"},
+      {"npm", "update"},    {"npm", "publish"},   {"npm", "exec"},
+      {"pnpm", "install"},  {"pnpm", "add"},      {"pnpm", "dlx"},
+      {"yarn", "install"},  {"yarn", "add"},      {"bun", "install"},
+      {"bun", "add"},       {"pip", "install"},   {"pip", "download"},
+      {"pip3", "install"},  {"uv", "pip"},        {"uv", "add"},
+      {"uv", "sync"},       {"cargo", "install"}, {"cargo", "fetch"},
+      {"cargo", "update"},  {"cargo", "publish"}, {"go", "get"},
+      {"go", "install"},    {"go", "mod"},        {"gem", "install"},
+      {"dotnet", "restore"}, {"dotnet", "add"},   {"winget", "install"},
+      {"choco", "install"}, {"scoop", "install"}, {"apt", "install"},
+      {"apt-get", "install"}, {"pkg", "install"}, {"brew", "install"}};
+  if (!cmd)
+    return 0;
+  const char *prev = NULL;
+  size_t prev_n = 0;
+  for (const char *p = cmd; *p;) {
+    while (*p && strchr(" \t\r\n;|&()<>`'\"$=", *p))
+      p++;
+    const char *w = p;
+    while (*p && !strchr(" \t\r\n;|&()<>`'\"$=", *p))
+      p++;
+    size_t n = (size_t)(p - w);
+    if (!n)
+      break;
+    /* /usr/bin/curl, C:\tools\curl.exe */
+    for (size_t i = n; i > 0; i--) {
+      if (w[i - 1] == '/' || w[i - 1] == '\\') {
+        n -= i;
+        w += i;
+        break;
+      }
+    }
+    for (size_t i = 0; i < sizeof(TOOLS) / sizeof(TOOLS[0]); i++)
+      if (net_word_eq(w, n, TOOLS[i]))
+        return 1;
+    for (size_t i = 0; prev && i < sizeof(PAIRS) / sizeof(PAIRS[0]); i++)
+      if (net_word_eq(prev, prev_n, PAIRS[i][0]) &&
+          net_word_eq(w, n, PAIRS[i][1]))
+        return 1;
+    if (n && w[0] != '-') {
+      prev = w;
+      prev_n = n;
+    }
+  }
+  return 0;
+}
+
 /* --- read-only command rules ---------------------------------------------- */
 
 #define SAFE_MAX_WORDS 64