[macbyclp]

What this does

Makes the engine run natively on Windows (no WSL), keeping the Linux/macOS code paths as they were.

• Platform layer (orvant_op/uyum.py, uyum_komut.py, uyum_surec.py): file locks via LockFileEx (same BlockingIOError contract as flock), atomic replace with retry, junction/symlink rejection, no-follow open, Job Object process-tree kill, Windows-aware command parsing, UTF-8 console I/O. fcntl, killpg, O_NOFOLLOW, /proc, /bin/sh and similar are no longer imported or called directly on Windows.
• Oracle isolation on Windows (mimar/yalitim_windows.py, mimar/kehanet.py): runs through codex sandbox (elevated mode) with the same fail-closed rule: if isolation cannot be proven, the oracle does not run. The sandbox user cannot execute a Python from the user profile, so a readable copy is created explicitly with python -m orvant_op.mimar.yalitim_windows kur (never silently).
• CI: Linux/macOS/Windows x Python 3.11/3.12 matrix, engine_tests step, skill tests that skip when symlinks are unavailable.
• Housekeeping: .gitattributes forces LF so hashes and managed-file comparisons stay stable under core.autocrlf=true; Windows docs in docs/WINDOWS.md and docs/WINDOWS.tr.md.

Verified (Windows 11 Home, Python 3.12, codex-cli 0.158.0, default cp1254 encoding)

• engine_tests: 103 tests OK (2 POSIX-only skipped).
• Existing tests/: 237 tests OK (7 skipped here because symlink creation needs privileges; they run where symlinks work).
• orvant --help and the sub-command help screens; the model-free flow (karsila baslat, sorular).
• Real codex sandbox run, 22 tests: writes outside the gate tree and outbound TCP are blocked; missing Codex / missing sandbox Python / unreadable profile Python all fail closed.

Not verified

• Linux and macOS were not run for these changes. I compared the old and new kehanet.py forced into Linux mode (command, environment and result were identical for both backends) and kept POSIX branches unchanged, but please let your CI confirm.
• Python 3.11 on Windows, the unelevated Codex sandbox mode, pip install . / the orvant.exe entry point, and a Claude Code worker on Windows.

Known Windows-only security limit

Inside the Windows sandbox, DNS lookups can still leave through the system DNS service and the sandbox can read the whole disk (same read level as bwrap's --ro-bind / /). The oracle script itself has no network access, but a worker program it runs could leak data over DNS. Linux has no such channel. This is documented in both READMEs and docs/WINDOWS.md.

Notes for review

• Shell-syntax acceptance commands on Windows use Git Bash when available; without it, POSIX-only syntax fails with an explicit error.
• On Windows there is no directory fd or O_NOFOLLOW, so the check-to-use window in teshis/gecici_artik and yurutme/kat_kapi is weaker than on POSIX (commented in code).
• Changes are split by area, so it should be reviewable per file group; happy to rework this into smaller PRs if you prefer.