feat(windows): implement Run/RunOnce collector and snapshot CLI

[XiaojuCH]

Summary

• implement the first real read-only Windows Collector for documented Run/RunOnce Registry locations, including HKCU Shared and explicit x64 Registry32/Registry64 scopes
• add systemdiff snapshot -o <path> with deterministic draft-v1 JSON, canonical UTC, bounded serialization, and no-overwrite output
• preserve lossless Registry value names, full native-byte SHA-256, strict typed decoding, scoped diagnostics, bounded mutation retry, and incomplete-coverage safety
• update fixtures and public documentation while keeping Services, Scheduled Tasks, rules, redaction, and GUI explicitly planned

Schema and safety

• pre-v0.1 RegistryValueName is now tagged and lossless for invalid UTF-16
• diagnostics may identify a coverage scope
• production Rust uses query-only Registry access and contains no Registry write API
• Registry write behavior exists only in the dual-gated, HKCU-only synthetic E2E harness
• generated Snapshots remain unredacted and are documented as privacy-sensitive

Validation

• cargo fmt --all --check
• cargo clippy --locked --workspace --all-targets -- -D warnings
• cargo test --locked --workspace --all-targets — 71 passed
• both fixture Diff commands and collectors — exit 0
• real non-elevated Windows build 26100 E2E — before absent, synthetic HKCU Shared Run REG_SZ added, after present, exactly 1 Added / 0 Removed, expected identity matched
• exact-data guarded Registry cleanup verified; recovery confirmed absence; temporary Snapshots deleted and not uploaded
• independent review — High 0 / Medium 0 / Low 0

Closes #5