fix: harden watcher stability and Windows smoke coverage

[IvanLarinDev]

Summary

• publish immutable watcher routing snapshots and make cancellation/stateful test isolation deterministic
• move auto-sorted items without overwrite or shell auto-rename; directory moves use atomic Directory.Move, so unsupported cross-volume directory routes fail safely and preserve the source
• add real Windows named-pipe, shell/FileOps, cross-volume, conflict, and NTFS junction smoke coverage
• split CI into unit/integration tiers, verify the published executable, harden release validation/docs, and pin softprops/action-gh-release to the audited v3.0.2 commit

Safety contract

• existing destinations are never overwritten or merged by watcher auto-sort
• files retain cross-volume move support
• directories move atomically only when Windows supports the rename; cross-volume directory moves return failure without copying or deleting the source
• tests create an isolated junction fixture with mklink /J and remove it during cleanup

Verification

• focused ad-hoc verification: Release build + 5/5 MoveWithoutOverwrite regressions; temporary script cleaned
• dotnet build Dropwheel.slnx -c Release --no-restore -warnaserror — 0 warnings, 0 errors
• unit tier — 471/471
• Windows integration tier — 7/7 in five consecutive runs, skipped 0
• staged-only dotnet format --verify-no-changes
• CI and release YAML parse
• CI framework-dependent publish produced Dropwheel.exe
• release framework-dependent and self-contained publishes produced Dropwheel.exe
• sensitive-literal/static sanity scan and git diff --cached --check
• independent fail-closed review of all 17 staged files: no security concerns or logic errors

Follow-ups

Reproducible SDK/runtime/package pinning and richer published-app launch smoke remain separate roadmap items to keep this PR focused.