feat(windows): implement Windows Services collector

[XiaojuCH]

User outcome

SystemDiff now captures and compares Registry Run/RunOnce startup entries and Windows service configuration in the normal Snapshot pipeline.

Collector scope

• Adds windows.services v1 for Win32 services visible to the current token.
• Excludes driver-only service types using native service-type flags.
• Uses query-only SCM access; it never creates, changes, starts, stops, or deletes a service.
• Treats current-token/object-ACL visibility as permanently best-effort partial coverage.

Evidence

Each atomic observation preserves the service name, display name, raw service/start/error values, unexpanded binary path, account, dependency sequence, load-order group, tag ID, delayed-auto-start flag, and description. If any selected query is unreadable, malformed, unstable, or over budget, the item is omitted with a scoped diagnostic while complete siblings remain.

Coverage semantics

Because Windows can silently omit services for which the caller lacks status-query access, real Services coverage is never claimed complete. A one-sided absence therefore becomes Inconclusive instead of a false Removed result. Synthetic complete-coverage fixtures separately test generic Added/Removed behavior.

Validation

• cargo fmt --all --check
• cargo clippy --locked --workspace --all-targets -- -D warnings
• cargo test --locked --workspace --all-targets (113 passed)
• Human, technical, and JSON synthetic Service fixture smoke tests
• Two real read-only Windows captures (341 retained Service observations each, zero driver-only artifacts, zero observed changes)
• Local portable x64 package and artifact-only verification, including a real read-only Snapshot
• Independent review: High 0 / Medium 0 / Low 0 after fixes

Explicit non-goals

No Scheduled Tasks Collector, service writes/remediation, runtime state/history/session tracking, command execution, signature or risk analysis, GUI, installer, release, or signing is added.

Closes #11