ci: enforce Windows/Wine compatibility policy

[mark-e-deyoung]

Summary

• replace advisory-only compatibility matching with a deterministic reviewed baseline and capability inventory
• add policy fixture tests and make the PR lint job fail on policy regressions
• make Wine daemon readiness exhaustion fail explicitly
• document the evidence hierarchy, binary/installer/runtime layers, and NIST covering-array experiment design

Validation

• �ash scripts/tests/test-wine-compat-policy.sh (CI Linux container)
• �ash scripts/wine-compat-policy.sh --all --ci (0 warnings, 0 errors)
• �ash scripts/lint.sh (pass; minimal container reports optional tools unavailable)
• git diff --check`n

Tracking

Advances #298. This PR intentionally does not claim that source scanning proves Wine compatibility; runtime matrix and installer lifecycle automation remain follow-up work.

Stacked on #297.