feat: add Windows alpha portable bundle

[Jumpstile]

Scope

Implements Issue #173 as a Windows x64 portable per-user local-server bundle. No Windows Service, Docker, release, tag, or merge.

Implementation

• Bundles the official PowerShell 7.6.6 win-x64 portable ZIP, pinned by archive SHA256; it no longer copies the local WindowsApps/MSIX runtime.
• Beginner .cmd launch/install/update/uninstall entrypoints.
• Loopback-only launcher at http://127.0.0.1:8765/ with bounded health check.
• package-manifest.json with source SHA, official runtime archive URL/SHA256, runtime tree hash, per-file lengths/SHA256, deterministic ZIP timestamps/order, and exclusion checks.
• Reuses the existing updater core for manifest verification, backup-first update, protected-state preservation, rollback, and uninstall/purge boundaries.
• Existing-install upgrades run the updater from the extracted source bundle runtime so installed runtime DLLs are not locked during replacement.
• Documentation and stable real implementation screenshots under docs/user/assets/alpha1-windows/.
• ARCADE hardware/software is not required for this local-machine validation; no ARCADE claim is made.

Fixed final candidate

• Commit: d3f47cd3197ea1d037826b1d86e6ef8d97a8df3c
• Base: 16117f1c3ccef1cea263252548847e07707105dc
• Artifact: ChannelForge-v0.1.0-alpha.1-windows-x64.zip
• ZIP SHA256: 1f5b1d80d43261d40c249d4bc159a57d7f2b70b91a15987162034bba2dcbcd9d
• Manifest SHA256: be9d87842f43b399299cae82cfb48005c14d18058d3a700a138355dd0e131659
• Runtime: PowerShell 7.6.6
• Runtime tree SHA256: eaacb58304b2fea841a1cb9faff6c4efc12e6791bac467033c67ddd70c5b51a2
• Runtime archive SHA256: 02fe458be20493fbdf43f61ea20610b811ee6c738ab1676c61b9cfcd1a33c860
• Files: 823

Verification

• Package-only validation used the exact ZIP and bundled runtime; repository runtime/tools were not used for the installed-package workflow.
• Fresh install: pass.
• Normal installed Start launcher and loopback HTTP: pass.
• Browser Guided Setup with isolated M3U/XML fixtures: pass; one exact guide match, zero review warnings.
• Proposal acceptance: pass; accepted lineup persisted.
• Restart, source enrollment, and Refresh now: pass; accepted/up-to-date state persisted.
• Valid packaged update: pass; protected state survived.
• Corrupt package manifest rejection: pass; installed marker and old HTTP service remained usable.
• Uninstall retained user data: pass.
• Reinstall retained accepted state: pass.
• Purge confirmation boundary and unrelated-file preservation: pass.
• Final exact-candidate lifecycle smoke after this documentation commit: pass.
• Focused Pester package/updater suites: 45 passed, 0 failed.
• Deterministic rebuild comparison: matching ZIP SHA256.
• Hosted PowerShell CI quality-gates: PASS, run 35532604744.
• Hosted secret-scan: PASS, run 35532604744.

Evidence screenshots

• Install: docs/user/assets/alpha1-windows/01-install-bundle.png
• Started browser: docs/user/assets/alpha1-windows/02-started-browser.png
• Guided Setup: docs/user/assets/alpha1-windows/03-guided-setup.png
• Accepted/restart: docs/user/assets/alpha1-windows/04-accepted-restart.png
• Refresh: docs/user/assets/alpha1-windows/05-refresh-now.png
• Update: docs/user/assets/alpha1-windows/06-update-windows.png
• Uninstall: docs/user/assets/alpha1-windows/07-uninstall-windows.png

No merge, release, or tag requested or performed.

[Jumpstile]

Acceptance-flow clarification after reviewing the reported 422:

• Reproduced against the exact final ZIP 1f5b1d80d43261d40c249d4bc159a57d7f2b70b91a15987162034bba2dcbcd9d, using only the extracted package and its bundled PowerShell runtime.
• Clean bundled-server proposal request with the XMLTV fixture returned HTTP 200, Status=PROPOSAL_READY, ExactGuideMatchCount=1, CanAccept=true.
• Clean bundled-server acceptance request returned HTTP 200, Status=ACCEPTED, GuideStatus=XMLTV_ACCEPTED, and EnrollmentStatus=SAVED.
• state/accepted-lineup.json existed after acceptance.
• The accepted-state screenshot independently shows Accepted, Lineup accepted, and Accepted lineup confirmed.

The reported 422 was not reproducible in this clean exact-package run. The earlier failing attempts involved repeated/stale browser harness interactions; no packaged acceptance defect is evidenced. Validation server and temporary roots were cleaned afterward.

[Jumpstile]

BLOCKER — request-body read must be bounded before PR #174 can merge.

The final packaged candidate otherwise passed local package-only validation, screenshots, reproducibility, lifecycle smoke, and hosted exact-head CI. However, the live server body reader currently loops on Stream.Read(...) until EOF and does not bound the read by the declared Content-Length or a read timeout. During final package forensics, alternate POST clients produced requests that could hang the server request loop even though the ordinary browser path later reproduced cleanly.

Required narrow remediation:

1. If ContentLength64 >= 0, read exactly that many bytes (subject to MaxBytes), fail closed on short/extra body, and do not wait for EOF after the declared length is satisfied.
2. If ContentLength64 < 0 / chunked or unknown length, either:
   • safely support it with an explicit bounded read timeout/cancellation and MaxBytes enforcement, or
   • reject it immediately with a safe 411/400-style response. For Alpha.1, immediate rejection is acceptable if browser/fetch requests always send Content-Length.
3. No request may block the single-threaded listener indefinitely.
4. Add real server tests, not only direct helper tests, for:
   • declared-length POST completing without EOF wait;
   • declared-length mismatch;
   • oversized request;
   • unknown/chunked/no-length behavior;
   • server remains responsive to /health after rejected/malformed body.
5. Preserve existing proposal/acceptance API behavior and privacy.
6. Re-run packaged Guided Setup proposal + accept using the extracted exact candidate after the fix.
7. Because code changes alter the PR head, rebuild the deterministic ZIP, update hashes/evidence, rerun focused/full gates and hosted exact-head CI.

Do not merge/release/tag until this is cleared.