Prepare Tenebra 0.6.0: Windows reliability and redesigned desktop modes

[Divaaaan]

Prepare Tenebra desktop 0.6.0 with reliable connection state, redesigned simple and main modes, and Windows service, proxy and installation fixes. Failed TCP probes remain selectable and are no longer treated as proof that a VPN tunnel cannot connect. Local service, engine and proxy failures are distinguished from unavailable nodes.

Windows applies and restores the interactive user's system proxy with durable ownership, authenticates installed service IPC, bounds pending requests and ties engine lifetime to the core. Persistent WFP protection survives process failure; explicit OFF, Disconnect and verified uninstall own cleanup. Native packet acceptance remains mandatory before publishing these guarantees.

Both modes have consistent connection actions, first import, server selection, settings and diagnostics, with explicit busy, error and protection states. The main view adds searchable servers and consistent panels. Routing fixes preserve effective split settings, reject unusable multihop chains and bound crash recovery.

Native testing fixed limited process-image query access, elevated administrator token admission and missing System.ServiceProcess assembly loading in the NSIS stop-state check. The latter regression fails before the fix and passes in fresh x64/x86 Windows PowerShell.

Delivery synchronizes all seven version-bearing files. A main-only Actions workflow prepares the complete signed desktop candidate without a stable tag or public release. Promotion verifies signatures and acceptance bound to the exact source, workflow run, artifact and bytes, then publishes those same bytes. Live main and Latest checks prevent historical workflow retries from rolling the stable channel backward. Android remains held for this desktop release.

Validation:

• CI 34661709409 passed all eight mandatory jobs on the preceding 5bdb676 head. New hosted CI is required for the integrated candidate workflow commits.
• Integrated signed candidate and release changes pass 42 scoped Node tests and git diff --check. Independent review reproduced the stale-promotion defect and verified its fix with 24 tests plus four actual API-adapter cases.
• The interface changes passed 814 frontend tests, TypeScript, ESLint and the production build, with real-component browser inspection in both languages/themes and compact layouts. Packaged WebView2 acceptance remains separate.
• Exact c83 Windows CI bytes passed native public 0.5.11 upgrade, same-version repair, uninstall preserving profiles and reinstall. Persisted authentication/profile digests and loaded profile IDs were preserved; administrator and actual limited interactive-user service checks passed.
• The first real network window reached physical-uplink capture readiness, but stopped before Connect because the harness read an actively written log with incompatible file sharing. The corrected reader passes a real concurrent-writer regression; this is not tunnel acceptance. UI PreBoot likewise stopped at a timestamp guard and awaits a diagnostic rerun.

Code integration enables private signed candidate preparation. Publication stays gated on the exact signed Windows package, GUI, user proxy, tunnel and full persistent-protection matrix, including independent IPv4/IPv6/DNS observations and failure/reboot scenarios. The original employee all-servers-unavailable incident remains unconfirmed pending its own diagnostic evidence.