refactor(plugin): add Python-free Windows OS primitives

[kmbroai]

Summary

Add the Windows OS primitives needed for TypeScript to replace the Python filesystem and locking helpers.

Changes

• Add owning Win32 handles for file I/O, metadata, exact-handle rename/deletion, and byte-range locks. Preserve raw UTF-16 paths and numeric Windows errors.
• Split the native crate into Unix and Windows modules, retaining the existing Unix implementation.
• Add x64 and arm64 Windows artifact jobs with Node 20.0 and 22.13 proofs for directory sharing, junctions, handle lifetime, and cross-process locks.

Testing

• On the rebased head: TypeScript compilation, SDK/MCP types, formatting, Rust formatting, Ruff, portable source checks, and all nine checker tests passed.
• Fresh Linux builds and native behavioral proofs passed on Node 20.0 and 22.13, including Python lock interoperability during independent review.
• The original implementation is unchanged by the rebase. Earlier platform and full SDK validation is recorded in the PR history; fresh hosted jobs will verify this head.
• Native review included Windows target Rust checks. Actual x64/arm64 Windows execution remains a hosted CI gate.

Risk and rollout

Stacked on #794. This is opt-in preparation; product commands do not use the new bindings yet. Universal package assembly and successful native Windows proofs are required before the TypeScript callers replace Python.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-03T19:09:11.295270Z	50b7aa2	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

Reviewed 90e2987. The native Windows x64 and arm64 proofs pass, and I found no actionable binding issues.

Holding approval for the Windows package verification timeout. The log reports successful installed-package validation before the outer smoke process hits its 210-second timeout. Please rerun this job on the reviewed head. If it repeats, investigate smoke-process exit and cleanup; the log alone does not establish a native-binding regression.

[mldangelo-oai]

The Windows package verification rerun passed on the unchanged reviewed head, clearing my earlier hold. Both native Windows x64 and arm64 proofs pass. No actionable findings in the binding changes.