test(ci): land Windows-first packaged desktop E2E and registered browser quarantine

[slashdevcorpse]

Context

PR #130 prototyped cross-platform unit/browser lanes, a quarantine registry, and packaged Electron E2E, but its exact head 84cdefe5fbbe49ff7bb4aebea3259da53855bd5b is stale-base and not merge-qualified. It is intentionally deferred from the Windows .9 release.

Hosted evidence on that head:

• required quality failed;
• e2e_windows failed 2 of 7 journeys (Codex provider missing during readiness; terminal search remained No results);
• e2e_linux failed all 7 journeys;
• unit_windows failed 3 Windows Job smoke tests;
• unit_macos failed 15 tests;
• codecov/patch failed;
• five review threads remain unresolved, including workflow-contract allowlist bypasses.

Scope

Rebuild the useful test infrastructure on a fresh branch from current main, Windows first:

• run the complete unit suite in the existing Windows quality model;
• make the stable browser suite blocking on Windows;
• keep quarantine entries machine-readable, explicitly registered, bounded, and non-blocking only for the exact registered command;
• run offline packaged Windows Electron journeys with isolated homes/ports/workspaces, failure-only redacted diagnostics, and identity-verified test-process cleanup;
• preserve existing required Linux/macOS coverage without expanding macOS work in this goal.

This issue is test/CI only. Do not carry product runtime changes from PR #130.

Existing issue routing

• Adopted webview lifecycle product behavior: fix(desktop): stabilize adopted browser-webview lifecycle #123.
• Exact installed NSIS artifact and upgrade/uninstall qualification: test(windows): qualify the installed NSIS release artifact end to end #11.
• Production Windows process ownership and false-success cleanup: [Bug]: Windows process trees are not owned at creation and cleanup can report false success #7.
• Windows maintenance-lock integration lane: test(ci): run Windows maintenance-lock integration in the required Windows lane #113.

Acceptance

• Fresh-main PR contains only test, fixture, package, and workflow changes approved for this goal.
• The Windows packaged E2E lane passes all seven journeys on the immutable hosted head and passes a repeat run without assertion weakening.
• Stable Windows browser tests block; only exact registered quarantine commands may continue on error.
• Workflow validation binds matrix-runner exceptions to the intended job and rejects appended failure-masked commands.
• E2E network guards tolerate malformed completion URLs, diagnostics redact secrets/paths/content, and cleanup reports unknown/failure rather than false success.
• Quarantine validation has one non-duplicated source of truth and rejects future dates.
• All required exact-head checks pass with zero unresolved review threads.
• No release publishing, installer qualification, or product bug fix enters the diff.

[slashdevcorpse]

PR #134 is closed unmerged; this issue remains the canonical follow-up.

Exact-head disposition:

• head 4170d7b was 2 commits ahead and 3 behind current main (83d595b);
• scope was 7,164 additions / 177 deletions across 46 files, substantially rebuilding the unmerged PR test: harden cross-platform CI and packaged desktop E2E #130 prototype;
• unit_windows failed on the Windows Authenticode test's 5-second PowerShell module-load timeout;
• the first packaged e2e_windows run had not completed and the required repeat run had not started;
• review reported eight substantive P2/P3 findings plus duplicated loopback security-boundary logic.

The branch/history is retained for reuse, but its remaining CI was canceled after closure so it could not compete with the .9 release lane. No PR #134 code entered main or 0.5.5-super.9. A future implementation must start from fresh main, address the recorded review/test failures, and satisfy this issue's exact-head repeat-run acceptance criteria.