Add GitHub Codespaces ingress to the Windows shell

[coneilen]

TDD evidence

RED: zig test src\GraphModel.zig -> FAIL "project identity derives remote and global from Codable paths" at GraphModel.zig:1531, a codespace:// project is not reported as remote (56 passed; 1 failed)
GREEN: zig test src\GraphModel.zig -> All 57 tests passed
REGRESSION: pwsh Tools\windows\Tests\WindowsShell.Tests.ps1 -> All 96 tests passed, "Windows shell scaffold contract: PASS", exit 0

A second RED was taken at the integration point, by reverting only App.zig, MainWindow.zig and InputRouter.zig to their pre-change state while keeping the new harness contracts:

RED: pwsh Tools\windows\Tests\WindowsShell.Tests.ps1 -> throws "Windows shell contract: the Add Folder menu must offer codespace ingress next to the other repository sources"
GREEN: pwsh Tools\windows\Tests\WindowsShell.Tests.ps1 -> All 96 tests passed, scaffold contract PASS

Both REDs are behavior failures of the missing capability, not toolchain or fixture errors: the suites compile and run, and every other test in them passes.

What

Windows could open a local folder, clone over HTTPS, and attach an SSH remote. A codespace - the fourth source the macOS welcome flow has always offered (CodespaceFormView / WelcomeFeature / CodespaceClient) - had nowhere to go. This adds it with the same shape: discover, choose, validate, open. Existing local/clone/SSH ingress is untouched.

How

graphcode-windows/src/Codespaces.zig - the client half, pure logic so it tests without a window:

• locates gh.exe (GRAPHCODE_GH override, Program Files, WinGet Links/Programs, then PATH)
• gh codespace list --limit 500 --json name,displayName,repository,state, parsed tolerantly (malformed rows dropped, unknown state kept as gh words it)
• classifies the failures gh actually returns - missing CLI, unauthenticated, missing codespace scope, no network, unreadable list - each into a remediation a human can act on
• redacts any gho_/ghp_/ghu_/ghs_/ghr_/github_pat_ run, plus control characters, out of gh output before it can reach a status line
• builds the validation argv and the codespace:// project URI
• persists only the codespace name and repository path to %LOCALAPPDATA%\GraphCode\codespace.ini

Validation dials gh codespace ssh with BatchMode=yes so it can never block on a prompt, and runs git rev-parse --show-toplevel in the chosen path, so an accepted identity is one whose sessions can actually start.

graphcode-windows/src/WindowsCodespaceDialog.zig - the sheet. Its state lives in a Model that is exercised directly, so loading, empty-account (create link instead of retry), failure plus retry, in-flight validation, cancel-while-dialing, inline-failure clearing, and submit gating are all covered without driving Win32. Selecting a codespace prefills its default workspace path and never overwrites a human edit.

The window is standard controls with dark WM_ERASEBKGND/WM_CTLCOLOR* painting, a STATIC label before each control in z-order so UIA names them, IsDialogMessageW for tab, and Escape to cancel - no custom provider, so the accessibility harness sees a real control tree.

Daemon protocol: no change needed. Checked first. RemoteProjectLocation already parses codespace:// and already dials through the GitHub CLI, so an accepted codespace opens through the same openProject call every other source uses. The only portable addition is Windows gh.exe candidates in GhLocator, which otherwise listed macOS paths only while still compiling into the Windows target.

Also: Project.isRemote() now accepts codespace:// so it groups with remotes rather than as a filesystem path; and the recent-folders submenu is located rather than indexed, because adding this menu item is precisely what would have silently retargeted that rebuild at the wrong item.

Credential handling

No token or device-code secret is logged, echoed, persisted, or committed anywhere in this change. gh owns the credential store; this code never reads it. Every byte of gh output passes through sanitizeMessage, which strips token-shaped runs and control characters before it can reach a status line, and that stripping is asserted by test. The only persisted state is the codespace name and repository path. The single token-shaped literal in the tree is a synthetic redaction fixture (gho_EXAMPLENOTAREALTOKEN0000), labelled as such, and exists only so the redactor can be proven to remove it.

Validation status - read honestly

Verified, with output quoted above: the client logic, the dialog state model, the menu/command/ingress wiring, codespace:// project identity, the harness contracts, and a clean zig build.

Not verified: a real end-to-end Codespaces connect. The token available here lacks the codespace scope:

gh codespace list
error getting codespaces: HTTP 403 ...
This API operation needs the "codespace" scope. To request it, run:
  gh auth refresh -h github.com -s codespace

So the failure path is exercised for real against live gh, but discovery-success, selection against a real list, and a real validated dial are not exercised and are not claimed to be. This needs a reviewer with a codespace-scoped token to confirm. The parity ledger should record Codespaces connect as unverified pending that, not as validated.

Separately and unrelated to this change: the Swift half of the suite cannot build on this machine (error: missing required modules: '_complex', 'ucrt', and vcvars64.bat reports VsDevCmd.bat encountered errors). It fails compiling MailroomKit, which this PR does not touch. The Swift sources here parse clean under the 6.3.3 toolchain; the new XCTest in windows-tests/ needs CI to execute.