feat(windows): WireGuard client, auto-VPN, IAM, tray enrichment, installer, CI

Second milestone of the Windows parity work (DESIGN-WINDOWS.md §13).

WireGuard mesh client (signed, WSS-delivered):
- wireguard_apply / wireguard_remove commands: Ed25519-verified, gated on a new
  wireguard capability. Linux applies via wg-quick up/down; Windows installs the
  peer config as a WireGuardTunnel service via wireguard.exe
  (/installtunnelservice, /uninstalltunnelservice)
- state polling in the home monitor drives the blue tray icon and auto-VPN:
  connect when away from home + auto_vpn, disconnect on return (2m cooldown)
- tray VPN toggle and the auto-VPN checkbox are now live; the preference
  persists to agent.yml (PersistAutoVPN)

IAM on Windows (iam_windows.go):
- allowed_login_groups -> net localgroup; ssh_keys -> per-profile
  authorized_keys + %ProgramData%\ssh\administrators_authorized_keys;
  revoke_users -> helper logs off all of the user's WTS sessions;
  sudo_rules logged as no direct equivalent

Tray enrichment:
- Open Config (opens agent.yml), Clear enrollment (re-enroll) menu items
- set_auto_vpn persists; vpn_connect/vpn_disconnect/reinit/open_config commands
  handled by the daemon (tray_server.go)

Packaging & release:
- installer/windows/installer.iss: fully-offline Inno Setup bundle (agent,
  tray, helper, vendor-signed WireGuard MSI, OpenCredential CP, VC++ redist),
  /SILENT /SERVER_URL /JOIN_KEY parameters, SYSTEM service + HKLM Run tray
  autostart, Users-writable %ProgramData%\Theta42 for the IPC socket
- .github/workflows/build-windows.yml: build + test, pinned vendor downloads,
  ISCC compile, Azure Trusted Signing (OIDC), SHA256SUMS, GH release attach,
  optional SSO resource publish
- agent.yml.example documents auto_vpn, wireguard, service_name,
  desktop_helper, public_ip_detect

Tests:
- wireguard_apply/remove dispatch (allowed + capability-denied), PersistAutoVPN,
  ClearEnrollment; dispatch tests pin linuxPlatformOps with a temp WireGuard conf
- end-to-end verified against a local mock SSO on Windows: join-key enrollment
  (token persisted, join key blanked), discovery/telemetry pushed, signed
  arbitrary_bash verified + executed via powershell -EncodedCommand; tray IPC
  socket binds %ProgramData%\Theta42; LDAP byte-pump binds 127.0.0.1:389;
  helper update swap verified

Rebuilds all tracked dist binaries (v2.1.0).

home_detect.go

@@ -67,6 +67,21 @@ func SetVPNActive(active bool) {
 	homeState.mu.Unlock()
 }
 
+// SetAutoVPN records the auto-connect preference (initialized from agent.yml,
+// updated by the tray checkbox).
+func SetAutoVPN(v bool) {
+	homeState.mu.Lock()
+	homeState.autoVPN = v
+	homeState.mu.Unlock()
+}
+
+// AutoVPN returns the current auto-connect preference.
+func AutoVPN() bool {
+	homeState.mu.RLock()
+	defer homeState.mu.RUnlock()
+	return homeState.autoVPN
+}
+
 // StartHomeMonitor periodically refreshes the agent's public IP and pushes
 // updated tray status. Call as a goroutine from main().
 func StartHomeMonitor(cfg *Config, connectedFn func() bool) {
@@ -107,5 +122,62 @@ func checkAndPush(cfg *Config, connectedFn func() bool) {
 		siteName = "home"
 	}
 
+	// WireGuard state + auto-VPN (DESIGN-WINDOWS.md §5). The tunnel can be
+	// driven by the SSO (wireguard_apply/remove) or by the tray; polling keeps
+	// the tray icon blue and lets auto-VPN react to home/away changes.
+	if cfg.Capabilities.WireGuard {
+		vpn = defaultPlatformOps.WireGuardState()
+		SetVPNActive(vpn)
+		isHome := computeIsHome(agentIP, homeIP, connected, cfg.ServerURL)
+		handleAutoVPN(cfg, isHome, vpn, autoVPN, connected)
+	}
+
 	UpdateTrayStatus(connected, agentIP, homeIP, vpn, autoVPN, siteName, cfg.ServerURL)
 }
+
+// computeIsHome mirrors the home-LAN determination in UpdateTrayStatus: public
+// IP matches the directory's site IP, the server is local/LAN, or the site IP
+// is not yet known (assume local home).
+func computeIsHome(agentPublicIP, homePublicIP string, connected bool, serverURL string) bool {
+	if !connected {
+		return false
+	}
+	isLocalServer := strings.Contains(serverURL, "localhost") ||
+		strings.Contains(serverURL, "127.0.0.1") ||
+		strings.Contains(serverURL, ".local") ||
+		strings.Contains(serverURL, "192.168.") ||
+		strings.Contains(serverURL, "10.")
+	return (homePublicIP != "" && agentPublicIP != "" && agentPublicIP == homePublicIP) || isLocalServer || homePublicIP == ""
+}
+
+// lastAutoVPNChange gates auto-VPN so the home monitor (60s tick) does not
+// hammer connect/disconnect on every poll.
+var lastAutoVPNChange time.Time
+
+// handleAutoVPN connects the tunnel when away from home and auto-connect is on,
+// and drops it again once back on the home LAN.
+func handleAutoVPN(cfg *Config, isHome, vpn, autoVPN, connected bool) {
+	if !autoVPN || !connected {
+		return
+	}
+	now := time.Now()
+	if now.Sub(lastAutoVPNChange) < 2*time.Minute {
+		return
+	}
+
+	if isHome && vpn {
+		log.Println("[home-detect] back home; disconnecting WireGuard (auto-vpn)")
+		if err := defaultPlatformOps.DisconnectWireGuard(); err != nil {
+			log.Printf("[home-detect] disconnect failed: %v", err)
+		}
+		lastAutoVPNChange = now
+		return
+	}
+	if !isHome && !vpn {
+		log.Println("[home-detect] away from home; connecting WireGuard (auto-vpn)")
+		if err := defaultPlatformOps.ConnectWireGuard(); err != nil {
+			log.Printf("[home-detect] connect failed: %v", err)
+		}
+		lastAutoVPNChange = now
+	}
+}