[codex] Add native Windows oracle groundwork

[Yazington]

What changed

Adds native Windows groundwork for pi-oracle:

• allow npm installation on win32 in package metadata
• detect Windows Chrome executable/profile defaults
• use copy-based profile cloning on Windows instead of APFS clone or /bin/cp
• make auth profile safety checks accept Windows absolute paths while still rejecting the real Chrome user-data tree
• resolve PATHEXT-style Windows executables during preflight
• capture Windows process start times for tracked-process identity checks
• move check:oracle-extension to a platform-neutral Node script that writes bundles to os.tmpdir()
• document Windows prerequisites and beta support notes

Why

The package currently fails immediately on native Windows with EBADPLATFORM. After forcing install, the next blockers are macOS-specific defaults, /bin/cp profile cloning, and POSIX-oriented verification assumptions. This PR removes those first-order blockers while keeping macOS behavior intact.

Validation

Passed on Windows:

• npm install
• npm run check:oracle-extension
• npm run typecheck
• npm run typecheck:worker-helpers
• npm run pack:check

Not completed locally:

• npm run sanity:oracle stops on this Windows machine because zstd is not installed on PATH. The README now documents zstd as a Windows prerequisite.

[fitchmultz]

Thanks for the Windows groundwork here. I pushed a maintainer follow-up to this PR branch (08d2d57) with the review fixes and current main merged in. That is a normal process for cross-repo PRs when maintainerCanModify is enabled and the fixes are small/targeted; please pull the latest branch before continuing.

What changed:

• Merged current main so the PR is back on the latest 0.7.x/Grok-capable baseline instead of the older 0.6.17 package metadata.
• Kept Windows enabled in package.json while preserving the current Node floor (>=22.19.0) and dependency overrides.
• Replaced unbounded Windows profile copies with timeout-bounded robocopy paths in both extension-side runtime cloning and worker cloning.
• Added Windows process-tree cleanup via taskkill /t for timeout paths that launch through .cmd/shell wrappers, so hung agent-browser children are not left behind.
• Tightened profile path safety with platform-aware root and nested-path checks, including Windows drive roots and C:\... separators.
• Changed default state/jobs locations on Windows to use the platform temp dir instead of drive-root /tmp, while keeping /tmp behavior on macOS.
• Updated README/design notes and sanity source-contract checks for the Windows behavior.

Validation I ran on macOS:

• npm run verify:oracle
• isolated pi session loading ./extensions/oracle/index.ts and calling oracle_preflight; the extension loaded and preflight failed only because the isolated auth seed had not been bootstrapped.

Could you please test the latest branch on native Windows again? The most useful checks would be:

1. npm install
2. npm run verify:oracle
3. /oracle-auth for ChatGPT (and Grok too if you have it set up)
4. oracle_preflight / a tiny /oracle job, if auth is available

Please watch specifically for profile clone behavior, agent-browser close cleanup, and where the job/state directories land under %TEMP%.