feat: add select proxy groups and single-app Windows activation

[yiguodev]

Summary

• add strict schema-13 select proxy groups as acyclic route and DNS targets
• expose authenticated Controller APIs for querying and changing live group selections
• package the Windows foreground app, AppContainer VPN Provider, and full-trust Session Host under one manifest Application
• let the Provider launch the Session Host through FullTrustProcessLauncher and bind rendezvous tokens before Snapshot or runtime access
• publish revision-2 Windows artifact metadata only after validating all three PE architectures and hashes

Review follow-up

• cover malformed and reparse-point rendezvous records plus both token-mismatch handshakes
• align prepare/start and Provider-owned activation documentation with the implementation
• correct the local Gate 0 source/evidence scope and route-target terminology
• clear prior Windows output before building so failed validation leaves no consumable manifest

Validation — current Windows 11 ARM64 machine

• cargo test --locked --all-features --all-targets: 471 passed, 3 ignored
• cargo clippy --locked --all-features --lib --bins -- -D warnings
• cargo fmt --all -- --check
• uv run --project scripts --locked python -m unittest discover -s scripts/tests: 8 passed
• Ruff check and format check
• C header check and shell syntax checks
• real vcore-scripts build windows ARM64 release artifact set
• local loose-package Gate 0 feasibility: one Application, AppContainer Provider, medium-integrity Session Host, connect/stop, and rendezvous cleanup

Windows 10, native x64, WACK, production signing, and Partner Center validation are delegated to developers with those environments and are not claimed here.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[yiguodev]

Addressed the review follow-up in 35a19d9: strict rendezvous/handshake coverage, PE architecture validation with fail-clean output, contract/documentation alignment, corrected local Gate 0 evidence scope, and route-target terminology. Validation is limited to the current Windows 11 ARM64 machine; other environments are delegated to their developers.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.