feat(computer-use): add guarded Windows maka.cu/2 integration

[sunheyi6]

Summary

This replacement is rebuilt from the current apache/main after #4497 and supersedes the oversized integration attempt in #4595.

• Reuse the existing MakaCuService and shared maka.cu/2 backend on Windows; no second protocol or duplicate Windows service.
• Select the windowsCu artifact from the Desktop manifest and verify the complete helper directory by file set, size, and SHA-256 before spawning it.
• Package the helper only when the native release artifact exists.
• Add prepare-windows to record the exact artifact digest and provenance. distributionReady cannot be enabled by a command-line flag; it remains false until the exact artifact has CI provenance, Authenticode signing, clean-machine validation, and packaged conversation E2E evidence.
• Keep the product diff focused: no generated browser JSON, raw outputs, experiments, or compatibility-input subsystem from the previous attempt.

Validation

• npm run build --workspace @maka/computer-use — passed
• node --test scripts/prepare-windows-cu-helper.test.mjs — 4 passed
• Explicit Windows manifest/digest selection check — passed
• Desktop full typecheck remains blocked by unrelated existing main-branch type errors; no diagnostics reference the changed host or selector files.

Release boundary

This PR does not claim clean-machine or packaged real-conversation acceptance. The existing #4595 remains open for comparison; it is not modified or closed by this PR.

中文翻译

摘要

本 replacement 基于包含 #4497 的最新 apache/main 重建，用于替代 #4595 中体量过大的集成尝试。

• Windows 复用现有 MakaCuService 和共享的 maka.cu/2 后端，不新增第二套协议或重复的 Windows service。
• Desktop 从 manifest 选择 windowsCu artifact，并在启动前按文件集合、大小和 SHA-256 校验整个 helper 目录。
• 只有在 native release artifact 存在时才打包 helper。
• 增加 prepare-windows，记录 exact artifact digest 和 provenance。distributionReady 不能通过命令行参数开启；在 exact artifact 具备 CI provenance、Authenticode 签名、clean-machine 验证及 packaged conversation E2E 证据前，始终保持 false。
• 保持 product diff 聚焦：不带回上一版中的 generated browser JSON、raw outputs、experiments 或兼容输入子系统。

验证

• npm run build --workspace @maka/computer-use —— 通过
• node --test scripts/prepare-windows-cu-helper.test.mjs —— 4 个通过
• Windows manifest/digest 选择专项检查 —— 通过
• Desktop 全量 typecheck 仍被主线已有的无关类型错误阻断；本次修改的 host 和 selector 文件没有诊断。

发布边界

本 PR 不声称已经完成 clean-machine 或 packaged real-conversation 验收。现有 #4595 保留用于对比，本 PR 不修改也不关闭它。

[sunheyi6]

@M4n5ter @hqhq1025 cc