Add recoverable physical Windows GUI worker

[dreamlovesu32]

What changed

• add a distinct physical-windows worker profile and coordinator alongside the existing Hyper-V adapter
• drive real Windows input through a persistent, guarded Rust agent with exact account/session/PID/executable checks and Per-Monitor-V2 DPI coordinates
• add local UIA and persistent CDP observers, content-addressed candidate deployment, SHA-verified artifacts, and native save/open support
• add a detached continuous worker queue with lease, heartbeat, checkpoint, resource floor, stop request, candidate/commit binding, and evidence hashes
• update the physical-worker handoff and GUI progress/release-quality documents

Why

The dedicated Windows test computer must execute real automatic clicks without keeping Codex or token-heavy Computer Use in the loop. Hyper-V-specific VM, credential, checkpoint, and PowerShell Direct assumptions could not honestly represent this physical machine.

Fixes found during physical validation

• replace CDP artifact hashing that depended on PowerShell module auto-loading with .NET SHA-256
• opt the input agent into Per-Monitor-V2 DPI awareness so UIA, foreground rectangles, and SetCursorPos share physical pixel coordinates at 150% DPI
• preserve Hyper-V's dedicated-account policy while allowing the physical profile to bind the exact current dedicated-machine account

Validation

• npm run gui-platform:test — 80/80 passed
• npm run gui-platform -- audit — 25 scenarios, 0 gaps, 0 warnings
• CI=true npm run verify — passed on clean commit
• physical core.bond.draw-single.production — 2/2 actions, 2/2 oracles, 0 diagnostics
• physical core.document.save-open-roundtrip.production — 17/17 actions, 3/3 oracles, 0 diagnostics, including independent saved CCJS inspection

Current physical candidate SHA-256: 11bb7b20b2988b9cb9db856bc3398000b0bdbedeeaa39a6a04babfef2199133c.