Add a qualified native Windows amd64 runtime and release

Problem

Stoat can compile selected host primitives on Windows, but it does not yet have a qualified native Windows runtime or release. WSL behavior and cross-compilation do not qualify a native Windows product.

Initial target

• Host: maintained Windows 11 amd64 release
• Accelerator: QEMU WHPX
• Guest: Ubuntu amd64 first, then Debian amd64
• Distribution: signed and documented native release artifact

Acceptance criteria

• Freeze the supported Windows build and QEMU version floor from current primary sources.
• Add native process creation/control, identity checks, owner-restricted files, named-pipe or loopback control endpoints, dependency discovery, and seed-generation behavior.
• Handle Windows paths, drive letters, reserved names, long paths, symlinks/reparse points, and OpenSSH copy syntax explicitly.
• Qualify create, start, SSH, recipe application, copy, sharing, stop/restart, and cleanup on real Windows amd64 hardware with WHPX.
• Add a hosted or self-hosted hardware gate that records exact host, QEMU, guest image, and Stoat build identities.
• Produce a signed release artifact with installation, upgrade, rollback, and uninstall documentation.
• Keep unsupported Windows configurations fail-closed with actionable diagnostics.

Out of scope

• Windows guests
• Windows arm64 until suitable hardware and an independently qualified profile are available
• Treating WSL as the native Windows release

The issue names no files or tests, so begin by mapping the existing host/runtime, release, and hardware-gate entry points and reviewing primary sources for supported Windows 11 amd64 and QEMU versions. Done means a signed native artifact, documented lifecycle, fail-closed unsupported configurations, and qualification results recorded for real Windows amd64 hardware with WHPX.