test(go): Windows cross-build fails on syscall.Stat_t in daemon preflight

[gnanirahulnutakki]

Problem

On exact dev commit f9420aa5ee4c788537a9200dd55f55d7c026fa1b, the Go tree does not compile for Windows:

GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go test -c ./cmd/ardur-agent-recognition-benchmark
# github.com/ArdurAI/ardur/go/pkg/kernelcapture
pkg/kernelcapture/daemon_preflight.go:445:36: undefined: syscall.Stat_t

go/pkg/kernelcapture/daemon_preflight.go is untagged and directly type-asserts fs.FileInfo.Sys() to *syscall.Stat_t. That type is Unix-specific. Duplicate searches for the exact symbol and Windows build failure found no existing issue.

Impact

Any command importing pkg/kernelcapture fails before its own platform-specific behavior can be compiled or tested on Windows. This also prevents validating the existing !linux fail-closed implementations across all declared non-Linux targets.

Acceptance criteria

• Move platform-specific UID/GID extraction behind appropriately constrained files or an equivalent portable abstraction.
• Preserve current Unix ownership checks and fail-safe defaults (UID/GID = -1) where ownership is unavailable.
• Add a Windows cross-compilation test for at least pkg/kernelcapture and representative importing commands.
• Keep Linux and macOS unit/race coverage green.

Scope and risk

Portability/testability only; do not claim Windows kernel enforcement support. No cloud resource, IAM, secret, or runtime-cost change is expected beyond bounded CI minutes.

[gnanirahulnutakki]

Claiming this issue for the autonomous dev backlog run.\n\nEntry checks:\n- exact base: 07788d1\n- no assignee, implementation PR, matching remote branch, or existing worktree\n- no overlap with protected exclusions or active PR #314/#329\n\nI will keep the lane portability-only: preserve Unix ownership enforcement, retain fail-safe unknown ownership on unsupported platforms, add Windows cross-build coverage, and avoid any Windows enforcement-support claim.

[gnanirahulnutakki]

Closure evidence: PR #343 merged to dev as 5df32e2 after all required PR checks and current-head CodeRabbit review passed. Both commits are signed, DCO-compliant, and authored/committed by gnani.nutakki@gmail.com. The final immutable nine-file security diff review was complete with zero deferred surfaces and zero findings; govulncheck found no reachable vulnerabilities, and changed-file Trivy dependency/secret scans were clean. All sixteen non-recognition workflows triggered for the exact merge SHA are green. The remaining post-merge exception is the already-isolated hosted-runner recognition instability in #342: the dev push run 29572540863 preserved three failed artifacts with exact capture/recognition/fingerprint accounting, and retries were capped after attempt 3. No gate was bypassed and PR #17 was not modified or rerun. Durable records: Notion session https://app.notion.com/p/3a02637edb078192ba20cb1e13df7757 and decision log https://app.notion.com/p/3a02637edb0781e3a139df4ee4d99f6e. Work now moves to #342 as the explicit post-merge blocker.