fix(windows): restore safe sandbox operations and accurate session timestamps

[ssybs]

Summary

Restore Windows sandbox filesystem operations while preserving no-follow traversal, identity validation, atomic replacement and no-replace publication. Persist actual session creation, event processing and archive timestamps. Retain the narrowly scoped pre-admission SQLite initialization retry and the Trace rail/model-limit display fixes.

Windows filesystem fixes

• Replace flushed sibling stages with a single OS rename; never unlink the existing marker first. A failed replacement preserves the old marker.
• Traverse using native directory-relative handles, compare opened identities and retain ancestors without delete sharing. Reject intermediate reparse points, including junctions; exact deletion removes a junction itself rather than its target.
• Check file identity and hard-link count through the opened handle before secret overwrites. Reject aliases and identity substitution between opens.
• Treat missing registered credentials or their relative parents as successful cleanup while still rejecting missing/foreign roots, permission failures and reparse points.
• Publish directories with OS no-replace semantics. A competing destination leaves both its identity and the private stage intact.

The Windows implementation is isolated from the other platform adapters. Dependencies provide safe wrappers; no unsafe Rust is introduced. WINDOWS.md documents the handle strategy and caller ownership requirements. A Unix permission-specific existing provider test is now gated to Unix so Windows library tests compile.

Validation

Executed natively on Windows with Rust 1.96.0, using debug information disabled and incremental compilation disabled:

• cargo test -p awaken-sandbox-fs --locked: 13 passed, 0 failed, 0 ignored (includes the subprocess helper used by the interruption regression).
• cargo test -p awaken-sandbox-local --lib --locked provider::shred_tests: 13 passed, 0 failed, including missing-credential disposal and hard-link rejection/retry regressions.
• cargo clippy -p awaken-sandbox-fs --all-targets --locked -- -D warnings: passed.
• cargo fmt -p awaken-sandbox-fs --check and git diff --check: passed.
• Dependency-source and metadata-derived dependency-direction checks: passed. Staged repository hygiene and file-limit checks: passed.

Regression coverage includes injected and real replacement failures, process exit before replacement, intermediate junction escape attempts, retained-parent rename rejection, hard links, identity substitution between opens, missing credentials, and a concurrent directory publisher at the rename boundary. Added a dedicated Windows CI workflow to repeat filesystem checks and provider disposal regressions.

Full workspace tests, frontend checks and Unix execution have not been completed. The full architectural check was interrupted; only its dependency-direction component was separately verified. The whole-repository file-limit check reports the unchanged docs/design/resources-memory-files-skills.md at 1211 lines against a 1200-line limit. Provider test builds still emit unrelated existing Windows warnings. Local test results do not establish hardware power-loss durability or physical SSD erasure guarantees; remote CI status should be assessed separately.

[ssybs]

@chaizhenhua 麻烦审核一下这个 PR，谢谢。

[ssybs]

@chaizhenhua 麻烦审核一下这个 PR，谢谢。