Windows: official port -- UCRT static build, UTF-8 throughout, Low IL sandbox, ncurses TUI, installer; v0.6.0

Build
  * cross build switches to pkgsCross.ucrt64 (shell-win.nix); curl (Schannel),
    winpthreads and ncurses 6.6 are linked statically, so the release is
    cst-agent.exe + busybox.exe (busybox-w32 Unicode) with no extra DLLs
  * windres embeds a manifest with activeCodePage=UTF-8 and a version resource
  * ncurses 6.6 Windows console driver patches (mouse button state, A_DIM,
    wide-char declarations): scripts/patches/
  * scripts/bootstrap_msys2.sh builds the same release natively in MSYS2
    UCRT64; PR #1's MINGW64 notes now point there
  * vendor/tre-regex (musl's TRE) provides <regex.h> on MinGW

UTF-8
  * paths cross the system call boundary as UTF-16 (*W APIs); console code
    pages set to 65001 and restored on exit; files are read and written in
    binary mode
  * child output that is not valid UTF-8 is decoded from the console, OEM or
    ANSI system code page
  * read_file hides CR; edit_file, apply_patch and write_file keep CRLF line
    endings and a UTF-8 BOM

OS layer and processes
  * os_dir_* and cst_fnmatch replace the POSIX-only directory walks in
    subagent, plugins, skills, undo and fs_tools; realpath / path_under and
    symlink rejection work on Windows
  * every child goes through CreateProcessW with its own environment block
    inside a Job Object, so timeouts and Esc end the whole process tree

Sandbox (auto mode, "auto · lowil")
  * run_shell runs with a restricted Low integrity token; the workspace gets
    an inheritable Low label once, the sandbox TEMP is labeled Low, and the
    credentials file gets a no-read-up label
  * drive roots, the profile and system folders are never labeled
  * network commands still ask, since Low IL does not block the network;
    Access denied and MSYS2's 0xc0000142 offer a rerun outside the sandbox
  * /sandbox lists labeled folders, /sandbox reset-labels restores them

TUI
  * raster console fonts are switched to Consolas / NSimSun while running
  * the home logo falls back to text when the console font lacks U+2580
  * mouse drag copy goes to the Windows clipboard

Distribution
  * scripts/install_windows.ps1 installs a Gitea release into
    %LOCALAPPDATA%\Programs\cst-agent and adds it to the user PATH;
    cst-agent-update.cmd reruns it; scripts/release_windows.sh uploads the
    zip with the token taken from the environment
  * scripts/run_windows.bat is gone; docs/README-windows.md is rewritten

Tests
  * new test_lowil, test_win_utf8 and test_os_dir; tests made portable
    (cst_test_util.h)
  * scripts/win_test.sh and scripts/winvm/ run the suite on English and
    Chinese Windows Server VMs as Administrator, a standard user and a
    Chinese user name: 29/29 on all six

src/tools/tools.c

@@ -238,6 +238,22 @@ static int write_content(const ctl_tool_call_t *call, const char **content,
   return *content ? 0 : -1;
 }
 
+/* Overwriting a CRLF and/or BOM file with plain LF text keeps the file's
+ * style: malloc'd restyled copy, or NULL to write content as given. */
+static char *keep_text_style(const char *oldc, size_t olen, const char *s,
+                             size_t n, size_t *out_len) {
+  if (!oldc)
+    return NULL;
+  int has_crlf = 0;
+  for (size_t i = 1; i < n && !has_crlf; i++)
+    has_crlf = s[i] == '\n' && s[i - 1] == '\r';
+  int crlf = !has_crlf && cst_text_is_crlf(oldc, olen);
+  int bom = cst_bom_len(oldc, olen) && !cst_bom_len(s, n);
+  if (!crlf && !bom)
+    return NULL;
+  return cst_text_restyle(s, n, crlf, 1, out_len);
+}
+
 int cst_preview_write_file(const cst_tool_ctx_t *ctx, const ctl_tool_call_t *c,
                            char **out) {
   const char *path = tool_arg(c, "path");
@@ -252,11 +268,18 @@ int cst_preview_write_file(const cst_tool_ctx_t *ctx, const ctl_tool_call_t *c,
   char *oldc = NULL;
   if (cst_sandbox_resolve(ctx->workspace_root, path, full, sizeof(full)) == 0)
     oldc = tool_slurp(full, &olen, 0);
+  size_t sn = 0;
+  char *styled = keep_text_style(oldc, olen, content, n, &sn);
+  if (styled) {
+    content = styled;
+    n = sn;
+  }
   cst_buf_t b = {0};
   cst_buf_printf(&b, "%s %s (%zu bytes)\n", oldc ? "overwrite" : "create",
                  path, n);
   tool_append_diff(&b, path, oldc, olen, content, n);
   free(oldc);
+  free(styled);
   *out = cst_buf_steal(&b);
   return 0;
 }
@@ -276,14 +299,22 @@ int cst_tool_write_file(const char *workspace_root, const ctl_tool_call_t *call,
 
   size_t olen = 0;
   char *oldc = tool_slurp(full, &olen, 0);
+  size_t sn = 0;
+  char *styled = keep_text_style(oldc, olen, content, n, &sn);
+  if (styled) {
+    content = styled;
+    n = sn;
+  }
   if (tool_write_whole(full, content, n) != 0) {
     free(oldc);
+    free(styled);
     return tool_set_resultf(r, 1, "error: cannot write file: %.200s", path);
   }
   cst_buf_t b = {0};
   cst_buf_printf(&b, "wrote %s (%zu bytes)\n", path, n);
   tool_append_diff(&b, path, oldc, olen, content, n);
   free(oldc);
+  free(styled);
   return tool_take_buf(r, &b, 0);
 }