feat(windows): WireGuard client, auto-VPN, IAM, tray enrichment, installer, CI

Second milestone of the Windows parity work (DESIGN-WINDOWS.md §13).

WireGuard mesh client (signed, WSS-delivered):
- wireguard_apply / wireguard_remove commands: Ed25519-verified, gated on a new
  wireguard capability. Linux applies via wg-quick up/down; Windows installs the
  peer config as a WireGuardTunnel service via wireguard.exe
  (/installtunnelservice, /uninstalltunnelservice)
- state polling in the home monitor drives the blue tray icon and auto-VPN:
  connect when away from home + auto_vpn, disconnect on return (2m cooldown)
- tray VPN toggle and the auto-VPN checkbox are now live; the preference
  persists to agent.yml (PersistAutoVPN)

IAM on Windows (iam_windows.go):
- allowed_login_groups -> net localgroup; ssh_keys -> per-profile
  authorized_keys + %ProgramData%\ssh\administrators_authorized_keys;
  revoke_users -> helper logs off all of the user's WTS sessions;
  sudo_rules logged as no direct equivalent

Tray enrichment:
- Open Config (opens agent.yml), Clear enrollment (re-enroll) menu items
- set_auto_vpn persists; vpn_connect/vpn_disconnect/reinit/open_config commands
  handled by the daemon (tray_server.go)

Packaging & release:
- installer/windows/installer.iss: fully-offline Inno Setup bundle (agent,
  tray, helper, vendor-signed WireGuard MSI, OpenCredential CP, VC++ redist),
  /SILENT /SERVER_URL /JOIN_KEY parameters, SYSTEM service + HKLM Run tray
  autostart, Users-writable %ProgramData%\Theta42 for the IPC socket
- .github/workflows/build-windows.yml: build + test, pinned vendor downloads,
  ISCC compile, Azure Trusted Signing (OIDC), SHA256SUMS, GH release attach,
  optional SSO resource publish
- agent.yml.example documents auto_vpn, wireguard, service_name,
  desktop_helper, public_ip_detect

Tests:
- wireguard_apply/remove dispatch (allowed + capability-denied), PersistAutoVPN,
  ClearEnrollment; dispatch tests pin linuxPlatformOps with a temp WireGuard conf
- end-to-end verified against a local mock SSO on Windows: join-key enrollment
  (token persisted, join key blanked), discovery/telemetry pushed, signed
  arbitrary_bash verified + executed via powershell -EncodedCommand; tray IPC
  socket binds %ProgramData%\Theta42; LDAP byte-pump binds 127.0.0.1:389;
  helper update swap verified

Rebuilds all tracked dist binaries (v2.1.0).

agent.yml.example

@@ -1,5 +1,5 @@
 # theta-agent configuration file
-# Default location: /etc/theta42/agent.yml
+# Default location: /etc/theta42/agent.yml (Linux) or %ProgramData%\Theta42\agent.yml (Windows)
 
 server_url: "https://sso.example.com"
 
@@ -30,8 +30,25 @@ location: "default" # Location identifier (e.g., site, datacenter) for naming
 # from this socket to the SSO, which relays them into its OpenLDAP. The agent
 # never parses LDAP. Point SSSD at it with:
 #   ldap_uri = ldapi://%2frun%2ftheta%2fldap.sock
+# (Windows relies on the TCP loopback listener 127.0.0.1:389 instead.)
 ldap_socket: "/run/theta/ldap.sock"
 
+# Auto-connect the WireGuard tunnel when this host is away from home and the
+# directory WebSocket is up. The tray checkbox persists here too.
+auto_vpn: false
+
+# Windows-specific (DESIGN-WINDOWS.md §11). Ignored on Linux.
+service_name: "theta-agent"            # Windows service name
+desktop_helper: ""                     # theta-agent-helper.exe path (session-0 ops)
+public_ip_detect: true                 # false = air-gap: never call external IP services
+
+# WireGuard mesh client (DESIGN-WINDOWS.md §5). The signed wireguard_apply
+# command pushes the peer config down the WSS channel; these are local paths.
+wireguard:
+  tunnel_name: "theta-mesh"
+  conf: ""                             # "" = platform default (/etc/wireguard/... or %ProgramData%\Theta42\wg\...)
+  executable: ""                       # wireguard.exe path (Windows; "" = PATH/default install)
+
 capabilities:
   # ---------------------------------------------------------
   # Basic Capabilities (Safe, read-only or infrastructure management)
@@ -52,6 +69,9 @@ capabilities:
   # Apply node IAM (sudo rules, SSH keys, access control, revocation) (DESIGN.md §6)
   iam: true
 
+  # Accept signed wireguard_apply/wireguard_remove commands (DESIGN-WINDOWS.md §5)
+  wireguard: false
+
 # Secret templates to render (DESIGN.md §5). Each maps a local template to a
 # target file and an optional post-render reload. The template embeds secrets as
 # {{ bao "secret/data/nodes/<node-id>/<name>#<key>" }}.