Windows launcher (CI run only)

[basal-alfonso]

Draft to run the Windows CI job on the Windows launcher crate. Not for merge as-is.

---

Summary by cubic

Adds the Windows-only basal-launch crate to launch workers in an AppContainer with restricted tokens, job limits, and pre-resume checks, giving CI a way to exercise the confinement path.

• Gates weaker launch modes and test deviations behind the deviations feature; production builds expose only full confinement.
• Adds Windows integration tests for successful launches and refusal checks.
• Falls back to reduced access rights when opening the process token and tolerates already-existing profiles created concurrently.
• This is a CI validation draft and is not intended to merge as-is.

^{Written for commit 109994c. Summary will update on new commits.}

[basal-alfonso]

Closing: this attempt is being redone.