Implement Windows anonymous pipes and handle duplication

## Summary

The Windows filesystem provider already carries native HANDLE values through the portable descriptor layer, but `pipe`, `dup2`, and `fcntl` currently return `-ENOSYS`. This blocks portable pipe-based I/O and process output capture.

## Related issue

- #385

## Scope

Implement anonymous pipes and the handle-duplication behavior needed by `std::io` and the Windows process layer. Map only operations with a well-defined portable meaning; do not invent a broad `fcntl` emulation.

## Acceptance criteria

- `io_pipe` creates readable and writable endpoints on Windows.
- Duplicating or replacing standard input/output/error handles follows documented ownership rules.
- Closing either endpoint does not leak or double-close native handles.
- Unsupported `fcntl` commands remain explicit and deterministic.
- Windows-native tests cover a round trip, EOF after writer close, and standard-handle redirection.
- Existing Unix behavior is unchanged.

Locate the Windows filesystem provider and portable descriptor layer, then trace the existing pipe, dup2, and fcntl entry points that return -ENOSYS. Use the Windows-native test area as the starting point and cover pipe round trips, EOF after writer close, standard-handle redirection, ownership, and unsupported commands. Done means the Windows criteria pass without changing Unix behavior.

Written by the indexing model from the issue text.