Support Windows as a native AgentCall callee

[KenTaniguchi-R]

Why

Windows is not supported today:

• packages/cli/package.json publishes with "os": ["darwin"].
• README.md calls non-macOS platforms a v1 non-goal.
• setup installs a launchd LaunchAgent and current lifecycle code is Unix-oriented.
• managedPolicyPath() supports only darwin and linux.
• agent teardown uses detached Unix process groups and process.kill(-pid, SIGTERM/SIGKILL).
• local secret-store hardening relies on POSIX modes, which are not a Windows ACL boundary.

#14 added Linux support and was correctly closed by #195; this issue tracks the Windows portion that remains.

Blocked by

Blocked by #250 — land the native-Windows feedback loop and blocker inventory first.

Required behavior

• The packed CLI installs and runs on supported Windows x64 releases with Node 20, 22, and 24.
• setup, listen, doctor, status, credential rotation, and uninstall have Windows-native behavior and actionable diagnostics.
• The listener can be supervised per user and start at logon without keeping a terminal open. Prefer a per-user Scheduled Task (the closest analogue to launchd/systemd user services); document any different choice.
• Setup and uninstall are idempotent and do not require administrator privileges for the normal per-user install.
• Managed policy uses an absolute, environment-independent machine-owned location under %ProgramData%; AGENTCALL_HOME cannot relocate it.
• User config, tokens, policy, contacts, contexts, and logs use Windows-safe paths. Sensitive files receive meaningful Windows ACL protection rather than relying only on chmod.
• Agent binary discovery handles Windows executable resolution (.exe, .cmd, PATH/PATHEXT) and paths containing spaces.
• Timeout, cancellation, overflow, and listener shutdown terminate the full spawned agent process tree without orphaning grandchildren. The implementation must have a Windows-specific strategy rather than negative-PID Unix signaling.
• Guard/path comparisons are correct for drive letters, separators, case-insensitivity, UNC paths, and junction/reparse-point behavior where relevant.
• Existing macOS and Linux behavior remains unchanged.

Acceptance criteria

• Remove the Darwin-only npm restriction and declare the actual supported OS set.
• Native-Windows unit/integration tests cover paths, binary discovery, lifecycle management, ACL handling, and process-tree teardown.
• A clean Windows VM can complete setup, remain listening after the setup shell exits, receive and answer a call, handle cancellation and timeout, report status, rotate credentials, and uninstall cleanly.
• agentcall doctor identifies broken Scheduled Task, PATH, auth, ACL, and managed-policy states with repair guidance.
• README and install docs state the supported Windows editions/architectures and known limitations.
• The Windows CI gate from Establish native-Windows CI and compatibility harness #250 is green.

Non-goals

• A signed MSI/EXE installer is tracked separately; functional npm-installed support should not claim fleet-ready distribution.
• Windows containers are not a substitute for the desktop/user-session listener lifecycle.