feat(windows): platform ops, service wrapper, helper, and air-gap paths

First Windows parity milestone (DESIGN-WINDOWS.md §13 build order item 1).

- Add a PlatformOps abstraction so command dispatch is OS-neutral:
  - linuxPlatformOps keeps today's systemctl/journalctl/bash behavior (deliberately
    untagged so shared dispatch tests run on Windows CI)
  - windowsPlatformOps maps reboot/shutdown to shutdown.exe, service control to
    sc.exe (stop+start for restart), fetch_logs to Get-WinEvent, arbitrary_bash to
    powershell -EncodedCommand (byte-exact under arbitrary quoting), and declines
    configure_ldap (Windows logon goes through OpenCredential)
- Run theta-agent as a Windows service (x/sys/windows/svc): SYSTEM auto-start,
    SCM stop/shutdown handling; CLI install-service/remove-service via svc/mgr
- Add theta-agent-helper (session-0 companion): lock/display_off/logout via
    user32/wtsapi32, and staged self-update (wait for service stop, swap the
    locked exe, sc start)
- Self-update becomes platform-aware: Linux renames over the running binary;
    Windows stages .new and hands the swap to the helper (running exe is locked)
- Platform paths: agent.yml and tray.sock under %ProgramData%\Theta42 (the
    service runs as SYSTEM while the tray runs as the user, so the per-user temp
    dir no longer works for tray IPC); LDAP byte-pump falls back to TCP loopback
- config: service_name, desktop_helper, public_ip_detect (air-gap: skips
    external public-IP lookups in telemetry + home monitor), wireguard block
- cli: platform-aware config path + self-update artifact name + service restart
- tests: dispatch tests pin linuxPlatformOps; 0600 mode assertions gated to
    POSIX so the suite is green on Windows

Rebuilds all tracked dist binaries (v2.1.0).

tray_ipc.go

@@ -9,19 +9,19 @@ package main
 
 import (
 	"encoding/json"
-	"os"
-	"path/filepath"
 	"runtime"
 )
 
 // TraySocketPaths are the paths the daemon tries to bind, in order.
 //
-// Windows has no /run or /tmp; a Unix socket in the per-user temp dir works
-// there (AF_UNIX is supported since Windows 10 1803) and needs no admin
-// rights. Linux keeps the original /run/theta path with a /tmp fallback.
+// Windows has no /run or /tmp. The daemon runs as the SYSTEM service while the
+// tray runs as the logged-in user, so the socket lives in the shared data dir
+// (%ProgramData%\Theta42, created by the installer with a Users-writable ACL)
+// rather than a per-user temp dir — the two processes must agree on one path.
+// Linux keeps the original /run/theta path with a /tmp fallback.
 var TraySocketPaths = func() []string {
 	if runtime.GOOS == "windows" {
-		return []string{filepath.Join(os.TempDir(), "theta-tray.sock")}
+		return []string{windowsTraySocketPath()}
 	}
 	return []string{"/run/theta/tray.sock", "/tmp/theta-tray.sock"}
 }()
@@ -30,7 +30,7 @@ var TraySocketPaths = func() []string {
 // entry in TraySocketPaths on each platform.
 var TraySocket = func() string {
 	if runtime.GOOS == "windows" {
-		return filepath.Join(os.TempDir(), "theta-tray.sock")
+		return windowsTraySocketPath()
 	}
 	return "/tmp/theta-tray.sock"
 }()