Windows: official port -- UCRT static build, UTF-8 throughout, Low IL sandbox, ncurses TUI, installer; v0.6.0

Build
  * cross build switches to pkgsCross.ucrt64 (shell-win.nix); curl (Schannel),
    winpthreads and ncurses 6.6 are linked statically, so the release is
    cst-agent.exe + busybox.exe (busybox-w32 Unicode) with no extra DLLs
  * windres embeds a manifest with activeCodePage=UTF-8 and a version resource
  * ncurses 6.6 Windows console driver patches (mouse button state, A_DIM,
    wide-char declarations): scripts/patches/
  * scripts/bootstrap_msys2.sh builds the same release natively in MSYS2
    UCRT64; PR #1's MINGW64 notes now point there
  * vendor/tre-regex (musl's TRE) provides <regex.h> on MinGW

UTF-8
  * paths cross the system call boundary as UTF-16 (*W APIs); console code
    pages set to 65001 and restored on exit; files are read and written in
    binary mode
  * child output that is not valid UTF-8 is decoded from the console, OEM or
    ANSI system code page
  * read_file hides CR; edit_file, apply_patch and write_file keep CRLF line
    endings and a UTF-8 BOM

OS layer and processes
  * os_dir_* and cst_fnmatch replace the POSIX-only directory walks in
    subagent, plugins, skills, undo and fs_tools; realpath / path_under and
    symlink rejection work on Windows
  * every child goes through CreateProcessW with its own environment block
    inside a Job Object, so timeouts and Esc end the whole process tree

Sandbox (auto mode, "auto · lowil")
  * run_shell runs with a restricted Low integrity token; the workspace gets
    an inheritable Low label once, the sandbox TEMP is labeled Low, and the
    credentials file gets a no-read-up label
  * drive roots, the profile and system folders are never labeled
  * network commands still ask, since Low IL does not block the network;
    Access denied and MSYS2's 0xc0000142 offer a rerun outside the sandbox
  * /sandbox lists labeled folders, /sandbox reset-labels restores them

TUI
  * raster console fonts are switched to Consolas / NSimSun while running
  * the home logo falls back to text when the console font lacks U+2580
  * mouse drag copy goes to the Windows clipboard

Distribution
  * scripts/install_windows.ps1 installs a Gitea release into
    %LOCALAPPDATA%\Programs\cst-agent and adds it to the user PATH;
    cst-agent-update.cmd reruns it; scripts/release_windows.sh uploads the
    zip with the token taken from the environment
  * scripts/run_windows.bat is gone; docs/README-windows.md is rewritten

Tests
  * new test_lowil, test_win_utf8 and test_os_dir; tests made portable
    (cst_test_util.h)
  * scripts/win_test.sh and scripts/winvm/ run the suite on English and
    Chinese Windows Server VMs as Administrator, a standard user and a
    Chinese user name: 29/29 on all six

src/agent_loop.c

@@ -270,7 +270,7 @@ static void git_branch(const char *ws, char *out, size_t n) {
   for (int depth = 0; depth < 8; depth++) {
     char p[4200], line[512];
     snprintf(p, sizeof(p), "%s/.git", dir);
-    FILE *fp = fopen(p, "r");
+    FILE *fp = fopen(p, "rb");
     if (fp) {
       /* worktree / submodule: ".git" is a file "gitdir: <path>" */
       char gd[4096] = "";
@@ -286,7 +286,7 @@ static void git_branch(const char *ws, char *out, size_t n) {
         snprintf(p, sizeof(p), "%s/HEAD", gd);
       else
         snprintf(p, sizeof(p), "%s/.git/HEAD", dir);
-      fp = fopen(p, "r");
+      fp = fopen(p, "rb");
       if (fp) {
         if (fgets(line, sizeof(line), fp)) {
           line[strcspn(line, "\r\n")] = 0;
@@ -308,7 +308,13 @@ static void git_branch(const char *ws, char *out, size_t n) {
 
 static void os_label(char *out, size_t n) {
 #ifdef _WIN32
-  snprintf(out, n, "Windows");
+  char ver[64];
+  os_windows_version(ver, sizeof(ver));
+  snprintf(out, n,
+           "%s; run_shell is busybox sh (POSIX syntax and applets; write paths "
+           "as C:/dir or relative, Windows programs like git or python run "
+           "from PATH)",
+           ver);
 #else
   struct utsname u;
   if (uname(&u) == 0)
@@ -780,9 +786,14 @@ static void sandbox_escalate(turn_t *t, cst_tool_ctx_t *ctx,
     free(detail);
   }
   if (ans == CST_PERM_DENY) {
-    const char *note = "\n[cst: blocked by the sandbox (writes are limited to "
-                       "the workspace and temp dir, no network); the user did "
-                       "not allow running it outside]\n";
+    const char *note =
+        cst_sandbox_probe() == CST_SANDBOX_LOWIL
+            ? "\n[cst: blocked by the sandbox (writes are limited to the "
+              "workspace and temp dir); the user did not allow running it "
+              "outside]\n"
+            : "\n[cst: blocked by the sandbox (writes are limited to "
+              "the workspace and temp dir, no network); the user did "
+              "not allow running it outside]\n";
     cst_buf_t b = {0};
     if (tr->out)
       cst_buf_append(&b, tr->out, tr->out_len);
@@ -924,9 +935,11 @@ static void exec_begin(turn_t *t, pcall_t *pc, exec_t *x) {
       if (def->perm == CST_TP_WRITE) {
         ask = 0;
       } else if (def->perm == CST_TP_SHELL) {
-        if (cst_sandbox_probe() != CST_SANDBOX_NONE) {
+        int sb = cst_sandbox_probe();
+        if (sb != CST_SANDBOX_NONE) {
           ctx->sandbox = 1;
-          ask = 0;
+          /* the Low-IL sandbox does not stop network access */
+          ask = sb == CST_SANDBOX_LOWIL && cmd && cst_shell_uses_network(cmd);
         } else if (cmd && cst_shell_is_safe(cmd)) {
           ask = 0;
         }
@@ -1707,8 +1720,12 @@ void cst_agent_session_id(const cst_agent_t *a, char *out, size_t out_sz) {
     return;
   const char *p = a->cfg.session_path;
   const char *sl = strrchr(p, '/');
-  snprintf(out, out_sz, "%s", sl ? sl + 1 : p);
-  size_t n = strlen(out);
+  const char *base = sl ? sl + 1 : p;
+  size_t n = strlen(base);
+  if (n >= out_sz)
+    n = out_sz - 1;
+  memcpy(out, base, n);
+  out[n] = 0;
   if (n > 6 && strcmp(out + n - 6, ".jsonl") == 0)
     out[n - 6] = 0;
 }
@@ -1747,7 +1764,8 @@ void cst_agent_reload_notes(cst_agent_t *a) {
     fclose(fp);
     if (b.len && b.buf) {
       size_t clean_len = 0;
-      a->notes = cst_utf8_sanitize(b.buf, b.len, &clean_len);
+      size_t bom = cst_bom_len(b.buf, b.len);
+      a->notes = cst_utf8_sanitize(b.buf + bom, b.len - bom, &clean_len);
     }
     cst_buf_free(&b);
     return;