fix(windows): honor lifecycle locks and add an amd64 preview

[huangzesen]

Summary

This is the deliberately slim follow-up to #685 for the two HIGH Windows-readiness findings:

1. Lifecycle safety: Windows tryLock now uses the existing non-creating byte-0 LockFileEx authority and fails closed on unknown probe outcomes. Native Windows regression tests cover held, missing, and unusable lock paths.
2. Honest delivery surface: windows-latest now runs native TUI/Portal tests, vet, build, version smoke, exact three-member packaging, SHA256, and bootstrap safety smoke. v* tags publish only the exact amd64 preview zip, checksum, and bootstrap alongside the existing source release/Homebrew update.

Claim boundary

This remains an experimental TUI/Portal-only Windows amd64 preview. It does not claim a supported native Python/kernel runtime, agent lifecycle interoperability, arm64, signing, PATH/services, or built-in updater support. macOS, Linux, and WSL remain supported.

Review surface

• c545c496 — focused H1 lock fix + native Windows tests
• ad035489 — slim H2 native validation, exact assets, guarded update-by-rerun bootstrap, and concise docs
• 13 files, +488 / -82

The abandoned broader local candidate was never pushed; this branch was rebuilt fresh from exact base 476744469978f82cd740282af9f2eb7118cff5a5 after a 58% deletion pass.

Local validation

• git diff --check
• release YAML parse + exact publication gating regression
• Portal npm ci + production frontend build
• TUI and Portal full Darwin go test ./... + go vet ./...
• Windows amd64 TUI lock-test compilation, both-module vet, and both binary builds
• Linux amd64 TUI and Portal builds
• final worktree clean at ad0354892d0841cd58f616577aee21d9cf4edbc5

Native PowerShell/bootstrap execution is intentionally delegated to the new windows-latest job and must be green before merge.