Add safe flat Win32 code generation

[leileizhang (lei9444)]

Summary

• add a metadata-driven flat Win32 ABI model and immutable libffi call plans, isolated from WinRT and Classic COM
• generate idiomatic safe JavaScript bindings under @microsoft/dynwinrt/win32, with explicit raw access under /win32/unsafe
• model buffers, native layouts, resource ownership, pointer-bearing structures, and dedicated OVERLAPPED ReadFile/WriteFile promises
• add deterministic manifests, a safe-coverage census, CI gates, documentation, samples, and live E2E coverage

Safety model

• fail closed when ABI, layout, count, cleanup, ownership, or pointer contracts are incomplete
• retain Buffer-backed pointers and reject numeric data addresses from the safe entrypoint
• restrict DLL loading to bare System32 module names
• protect managed handles from close/consume races while asynchronous I/O is pending

Review hardening

• revalidate detached/transferred read Buffers on the JS thread before copy-back
• require managed resources for consuming handle APIs, including exact cleanup and lease checks
• check asynchronous leases while holding the same resource mutex used by lease creation and consuming native calls
• preserve NullNullTerminatedAttribute and ReservedAttribute through semantic projection
• use a centralized fixed eight-thread OVERLAPPED waiter; excess operations reject explicitly instead of allocating unbounded OS threads or consuming libuv workers
• bound aggregate descriptors/layouts and use fallible native allocations
• route APIs-only Windows.Win32.* namespace generation through flat Win32 and reject Python
• initialize WinRT explicitly in the standalone flat Win32 runner
• give every COM/Win32 Node E2E runner a 180-second process timeout and add stage diagnostics to returns.mjs

Coverage

• 8,959 of 18,321 eligible Windows.Win32 functions project safely (48.90%)
• unsupported callbacks, ambiguous ownership, recursive/nested pointer graphs, and unknown native layouts remain omitted with explicit reasons

Validation

• core Rust: 229 passed, 1 ignored
• codegen unit tests: 333 passed; real Classic COM and flat Win32 metadata suites also passed
• JavaScript: 44 passed, 2 environment-dependent skips
• E2E: Python 41/41, WinRT TypeScript 37/37, Classic COM 16/16, flat Win32 2/2
• flat Win32 E2E covers detached read buffers, capacity rejection, libuv availability, cancellation, and raw-handle consuming rejection
• hardened flat Win32 E2E passed four consecutive runs
• x86, x64, and ARM64 compile checks passed

[github-actions]

Mixed-language test coverage

Workflow status: ✅ Passed

Layer	Lines	Functions	Branches/regions
Rust, including native .pyd/.node	80.04%	75.75%	80.03% regions
Generated Python projections	77.01%	n/a	62.35% branches
JavaScript aggregate	18.83%	20.83%	52.26% branches
JavaScript runtime	23.42%	14.28%	7.14% branches
Generated WinRT projections	22.27%	20.02%	52.85% branches
Generated Classic COM projections	12.97%	23.45%	52.17% branches

View workflow run and download full HTML/LCOV/XML reports