feat: add Windows WinFsp services and native tray preview

[luohui1]

Adds the Windows filesystem preview with a global WinFsp drive, persistent SCM folding service, and native WebView2 tray. The original Codex home paths remain usable through guarded namespace links, and Windows writer probes, leases, directory sync and deletion receipts preserve the existing recovery checks.

The WinFsp frontend can stay mounted while its storage engine is replaced. Updates require paused folding and closed file handles; a failed candidate restores the previous engine. Existing combined installations need one offline upgrade before using this path.

The tray adds policy controls, actual batch progress, separate compression/pending/net metrics, 30-day aggregate history, incident details, and JSON diagnostics. Its independently implemented glass material follows the published iOS 27 control references, with light/dark and accessibility fallbacks. No Apple kit assets or session contents are included.

Validation:

• Windows adapter, worker lifecycle, tray state, accounting and engine-handover tests passed, including the WinFsp build-tag checks.
• go vet ./..., all-package Windows test compilation, the default CLI and WinFsp/tray builds passed.
• Real WebView2 checks passed policy persistence, pause, history loading, scrolling, window restoration, desktop/narrow/short layouts and menu/diagnostics interactions. Rendered pixel comparisons verified backdrop refraction.
• Isolated real WinFsp integration verified managed reads, flushed appends, open-handle refusal, unchanged mount nonce/frontend PID, engine replacement, failed-candidate rollback and subsequent writes.
• Linux and macOS CLI cross-builds passed. The complete Windows suite is not green: failures include Unix file-mode expectations, symlink privileges, POSIX/macOS FSKit fixtures, Windows handle sharing and directory-fsync assumptions. The focused checks above passed; this PR does not claim full Windows suite qualification.

All seven CI jobs passed at 0361d19: quality, Linux and macOS tests, release configuration, focused Windows preview checks, race checks and cross-builds. Windows uses the native Go cgofuse loader (CGO_ENABLED=0), matching the locally validated preview build.

This remains a preview. Full Desktop GUI, reboot/power-loss behavior, failure during an in-flight turn, and SYSTEM qualification of the new engine split are not complete. The current production mount was not restarted for the tray update or engine preparation. The Windows guide documents activation, rollback, tested evidence and these limits; CI now runs the focused Windows checks and builds.