Windows: official port -- UCRT static build, UTF-8 throughout, Low IL sandbox, ncurses TUI, installer; v0.6.0

Build
  * cross build switches to pkgsCross.ucrt64 (shell-win.nix); curl (Schannel),
    winpthreads and ncurses 6.6 are linked statically, so the release is
    cst-agent.exe + busybox.exe (busybox-w32 Unicode) with no extra DLLs
  * windres embeds a manifest with activeCodePage=UTF-8 and a version resource
  * ncurses 6.6 Windows console driver patches (mouse button state, A_DIM,
    wide-char declarations): scripts/patches/
  * scripts/bootstrap_msys2.sh builds the same release natively in MSYS2
    UCRT64; PR #1's MINGW64 notes now point there
  * vendor/tre-regex (musl's TRE) provides <regex.h> on MinGW

UTF-8
  * paths cross the system call boundary as UTF-16 (*W APIs); console code
    pages set to 65001 and restored on exit; files are read and written in
    binary mode
  * child output that is not valid UTF-8 is decoded from the console, OEM or
    ANSI system code page
  * read_file hides CR; edit_file, apply_patch and write_file keep CRLF line
    endings and a UTF-8 BOM

OS layer and processes
  * os_dir_* and cst_fnmatch replace the POSIX-only directory walks in
    subagent, plugins, skills, undo and fs_tools; realpath / path_under and
    symlink rejection work on Windows
  * every child goes through CreateProcessW with its own environment block
    inside a Job Object, so timeouts and Esc end the whole process tree

Sandbox (auto mode, "auto · lowil")
  * run_shell runs with a restricted Low integrity token; the workspace gets
    an inheritable Low label once, the sandbox TEMP is labeled Low, and the
    credentials file gets a no-read-up label
  * drive roots, the profile and system folders are never labeled
  * network commands still ask, since Low IL does not block the network;
    Access denied and MSYS2's 0xc0000142 offer a rerun outside the sandbox
  * /sandbox lists labeled folders, /sandbox reset-labels restores them

TUI
  * raster console fonts are switched to Consolas / NSimSun while running
  * the home logo falls back to text when the console font lacks U+2580
  * mouse drag copy goes to the Windows clipboard

Distribution
  * scripts/install_windows.ps1 installs a Gitea release into
    %LOCALAPPDATA%\Programs\cst-agent and adds it to the user PATH;
    cst-agent-update.cmd reruns it; scripts/release_windows.sh uploads the
    zip with the token taken from the environment
  * scripts/run_windows.bat is gone; docs/README-windows.md is rewritten

Tests
  * new test_lowil, test_win_utf8 and test_os_dir; tests made portable
    (cst_test_util.h)
  * scripts/win_test.sh and scripts/winvm/ run the suite on English and
    Chinese Windows Server VMs as Administrator, a standard user and a
    Chinese user name: 29/29 on all six

tests/test_models.c

@@ -8,18 +8,10 @@
 #include <stdlib.h>
 #include <string.h>
 
-#ifdef _WIN32
-int main(void) {
-  puts("test_models: skipped on Windows");
-  return 0;
-}
-#else
+#define CST_TEST_SOCKETS
+#include "cst_test_util.h"
 
-#include <arpa/inet.h>
-#include <netinet/in.h>
 #include <pthread.h>
-#include <sys/socket.h>
-#include <unistd.h>
 
 #define CHECK(c)                                                               \
   do {                                                                         \
@@ -32,35 +24,38 @@ int main(void) {
 /* One canned HTTP response per accepted connection. */
 static const char *g_responses[8];
 static int g_nresp;
-static int g_listen = -1;
+static test_sock_t g_listen = TEST_BAD_SOCK;
 static char g_request[4096];
 
 static void *serve(void *arg) {
   (void)arg;
   for (int i = 0; i < g_nresp; i++) {
-    int c = accept(g_listen, NULL, NULL);
-    if (c < 0)
+    test_sock_t c = accept(g_listen, NULL, NULL);
+    if (c == TEST_BAD_SOCK)
       return NULL;
-    ssize_t n = recv(c, g_request, sizeof(g_request) - 1, 0);
+    long n = recv(c, g_request, sizeof(g_request) - 1, 0);
     g_request[n > 0 ? n : 0] = 0;
     const char *r = g_responses[i];
-    ssize_t off = 0, len = (ssize_t)strlen(r);
+    long off = 0, len = (long)strlen(r);
     while (off < len) {
-      ssize_t w = send(c, r + off, (size_t)(len - off), 0);
+      long w = send(c, r + off, (int)(len - off), 0);
       if (w <= 0)
         break;
       off += w;
     }
-    close(c);
+    test_sock_close(c);
   }
   return NULL;
 }
 
 static int start_server(void) {
+  test_sock_init();
   g_listen = socket(AF_INET, SOCK_STREAM, 0);
-  CHECK(g_listen >= 0);
+  CHECK(g_listen != TEST_BAD_SOCK);
+#ifndef _WIN32
   int one = 1;
   setsockopt(g_listen, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one));
+#endif
   struct sockaddr_in a;
   memset(&a, 0, sizeof(a));
   a.sin_family = AF_INET;
@@ -118,7 +113,7 @@ int main(void) {
   CHECK(n == -1 && strstr(err, "500") != NULL);
 
   pthread_join(th, NULL);
-  close(g_listen);
+  test_sock_close(g_listen);
 
   /* nothing listening: network error, not an auth failure */
   n = cst_llm_list_models(base, "sk-test", ids, 8, err, sizeof(err));
@@ -127,4 +122,3 @@ int main(void) {
   puts("test_models: ok");
   return 0;
 }
-#endif