build(windows): produce a portable developer preview

[XiaojuCH]

User problem

Trying the current SystemDiff Registry workflow requires a Rust/MSVC development environment.

Outcome

CI now produces a portable Windows x86_64 Developer Preview after the existing Windows and Ubuntu correctness gates pass. A later fresh Windows job downloads the uploaded artifact and verifies/runs the packaged executable without Cargo.

Artifact contents

The Actions artifact contains:

• systemdiff-windows-x86_64.zip
• SHA256SUMS

The portable ZIP contains exactly:

• systemdiff.exe
• QUICKSTART.md
• LICENSE
• THIRD_PARTY_LICENSES.txt
• BUILD_INFO.txt

Verification

• locked Cargo release build for x86_64-pc-windows-msvc
• packaging-only static MSVC CRT
• AMD64 / PE32+ / CUI inspection
• exact normal import allowlist and no delay imports
• embedded asInvoker, uiAccess=false manifest extraction
• exact archive allowlists and SHA-256 verification
• artifact-only --help, collectors, human/technical/JSON fixture Diff
• real read-only Snapshot smoke from the extracted executable
• fmt, Clippy with warnings denied, and 88 workspace tests
• independent workflow/package/security review with no remaining findings

Important limitations

• This is not an official SystemDiff release and the package version remains 0.0.0.
• The executable is unsigned; Windows may show SmartScreen/reputation warnings.
• The current product is Registry Run/RunOnce only.
• Snapshot and report data remain unredacted.
• Actions artifacts require GitHub sign-in, expire after 14 days, and are not permanent Release assets.
• CI and PE inspection do not replace clean-machine validation on every supported Windows baseline before an official alpha.

Non-goals

No Services or Scheduled Tasks Collector, session/baseline UX, GUI, installer, package-manager publishing, updater, signing infrastructure, tag, Release, telemetry, or product networking is added.

Closes #9