fix(desktop): enable local remote access on Windows

[M4n5ter]

English

Summary

• Enable local Runtime Host remote access on Windows whenever the Desktop build includes Direct peer support, removing the stale macOS/Linux platform gate.
• Launch npm-backed local Host setup and update safely on Windows through the exact Node.js executable and npm CLI, without shell command construction.
• Show an explicit loading state and first-setup explanation while Windows prepares the managed Host.
• Keep Task Scheduler supervision headless with a dedicated Windows GUI-subsystem launcher. It preserves the interactive user's identity and network access, transports exact argv through Task Scheduler without environment expansion, owns the process tree, and replaces the previous JavaScript supervisor.
• Ship the launcher as an independent native artifact rather than coupling it to the peer transport crate.
• Preserve bidirectional exact-package handoff for existing managed Hosts: new controllers fall back to legacy addons/runners, while legacy controllers using the new addon are projected onto the native launcher. Normal repair/update transactions therefore migrate existing task definitions without a second lifecycle owner.

The installed lifecycle provider remains the source of truth; Desktop only checks the capability it actually needs.

Verification

• npm exec -- biome check for all changed files
• npm run typecheck --workspace @maka/desktop
• npm run typecheck --workspace maka-agent
• npm run build --workspace maka-agent && npm run test:dist --workspace maka-agent (793 tests passed, 3 skipped)
• cargo clippy --locked --all-targets -- -D warnings and cargo test --locked for native/runtime-host-peer
• Windows-target cargo check and Clippy for native/runtime-host-windows-task-launcher
• actionlint .github/workflows/cli-package-validation.yml
• Native Windows compatibility probes for both new-controller/old-addon and old-controller/new-addon handoff paths
• Native Windows release-package smoke from WSL through Task Scheduler setup, exact hostile argv preservation, idempotent activation, crash restart with one fresh process tree, definition replacement, retirement cleanup, managed lifecycle, and no visible console window

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented, reviewed, and verified the change, including native Windows testing.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

中文

摘要

• 当 Desktop 构建包含 Direct peer 能力时，在 Windows 上开放本机 Runtime Host 远程访问，删除过时的 macOS/Linux 平台限制。
• Windows 上通过明确的 Node.js executable 与 npm CLI 安全启动本机 Host 的 setup/update，不构造 shell 命令。
• Windows 首次准备 managed Host 时显示明确的加载状态和耗时说明。
• 通过独立的 Windows GUI-subsystem launcher 让 Task Scheduler 监督链保持无窗口。它保留交互用户身份与网络访问，通过 Task Scheduler 精确保真 argv、避免环境变量展开，持有进程树，并替代原 JavaScript supervisor。
• launcher 作为独立 native artifact 发布，不与 peer transport crate 耦合。
• 为既有 managed Host 保留 exact package 双向交接：新 controller 可回退到旧 addon/runner，旧 controller 配合新 addon 时则会投影到 native launcher。正常 repair/update 事务因此能迁移既有 task definition，且不会产生第二个生命周期 owner。

已安装的生命周期 provider 仍是事实来源；Desktop 只检查真正需要的能力。

验证

• 对全部变更文件运行 npm exec -- biome check
• npm run typecheck --workspace @maka/desktop
• npm run typecheck --workspace maka-agent
• npm run build --workspace maka-agent && npm run test:dist --workspace maka-agent（793 项通过，3 项跳过）
• 对 native/runtime-host-peer 运行 cargo clippy --locked --all-targets -- -D warnings 与 cargo test --locked
• 对 native/runtime-host-windows-task-launcher 运行 Windows target Cargo check 与 Clippy
• actionlint .github/workflows/cli-package-validation.yml
• 原生 Windows 双向兼容探针：new-controller/old-addon 与 old-controller/new-addon
• 从 WSL 驱动原生 Windows release-package smoke，覆盖 Task Scheduler setup、复杂 argv 精确保真、幂等 activation、崩溃后仅保留全新进程树、definition 替换、retire 清理、managed lifecycle，以及不出现可见控制台窗口

AI 使用

• 没有生成式工具作出实质贡献
• 生成式工具作出了实质贡献

工具与范围：Codex 完成实现、审查和验证，包括原生 Windows 实测。

检查清单

• 测试覆盖该变更且在修复前失败
• lint、format、typecheck 和受影响测试均在本地通过

此 PR 是否改变行为？

• 是——已在摘要中说明
• 否

[jackwener]

Approved at exact head 9d7ccd8013d5867e3e7410a33c54e2bf7035247d at the explicit direction of M4n5ter. No technical review was performed as part of this action; M4n5ter requested the approval and accepts responsibility for subsequent handling.

---

Review notice: This approval was submitted by an automated review agent operated by jackwener and is published at the direction of M4n5ter, who requested this action and is the human accountable for it.