fix(ci): upstream Windows SDK validation support

[prekshivyas]

Summary

Upstream the remaining Windows validation tooling found during the GitLab-to-GitHub comparison for #3326. This is a separate, main-based sweep: it does not duplicate the combined !98/!105/!108 runtime port or the work in #3163, #3221, and #3296.

Draft: native pre-commit and SDK unit tests pass, but broader Go code-generation and gateway parity checks still fail as detailed below. This is not physical MXC or NemoClaw qualification evidence.

Related Issue

Related to #2050 and the maintainer-requested upstreaming effort in #3326. Issue acceptance/RFC disposition for the wider Windows effort still needs maintainer confirmation.

Source comparison: GitLab main at ac7a3289, including its Windows tooling maintained through sync commit 23c166cb. This branch starts from GitHub main cc780d4e, independently of #3326. Source maintenance credit: Shailendra Singh; port and additional ARM64/cleanup fixes: Prekshi Vyas.

Changes

• Run tracked Cargo lockfile validation natively on Windows instead of skipping it.
• Adapt Go protobuf plugin/output paths for Windows; retain race detection everywhere except unsupported Windows ARM64. Correct Windows path/browser test expectations and explicitly skip POSIX mode-bit assertions on Windows, without claiming ACL validation.
• Use the x64 Biome binary on Windows, Windows protobuf plugin launchers, and the lockfile-matched native Rolldown binding for ARM64 Node. Preserve dependency resolution: no SDK manifest or lockfile changes.
• Launch deterministic gateway parity fixtures through Git for Windows Bash, including ARM64 Git layouts. Use unique, checked temporary directories and restore process environment after execution.
• Document the native Windows validation behavior and limitations. Existing non-Windows task implementations remain in place; the TypeScript test task now waits for type checking before the ARM64 dependency adjustment.

The comparison retained newer upstream runtime behavior and did not restore obsolete internal documentation or demos. This PR records the concrete remaining validation delta found; it is not a claim of exhaustive equivalence with every historical GitLab commit.

Testing

• mise run --skip-tools pre-commit: PASS on Windows ARM64, including Cargo lockfile checks, workspace/e2e Clippy, and governance-interceptor compilation. This is the documented native Windows task mode, not a check bypass.
• go test ./... in sdk/go: PASS; the four failing Windows assertions from the combined-port checkout are addressed. Two POSIX-permission tests explicitly skip their unsupported assertions.
• mise run --skip-tools sdk:ts:ci: PASS, including code generation, lint, type checking, build, and 105 tests. Verified the final run used the pinned Vitest 4.1.10 and left the SDK package manifest/lockfile unchanged.
• git diff --cached --check: PASS. No generated SDK or line-ending-only changes included.
• mise run --skip-tools go:ci: FAIL at go:proto-check; regenerated comments differ in list indentation/blank lines from the tracked bindings. No protocol fields differ in the observed comparison. Remaining aggregate stages are not claimed to pass.
• mise run --skip-tools test:e2e-parity: FAIL after the Bash/Python launcher succeeds; the current main fixture expects a guest_tls_ca line absent from its generated v2 config. The fixture/generator are unchanged by this PR. Temporary launcher cleanup completed.
• Linux/macOS/x64 full CI and physical MXC two-cycle qualification: not run for this tooling sweep.

Checklist

• Follows Conventional Commits
• Commit is SSH-signed and DCO-signed-off
• Testing/build documentation and the existing Windows build skill updated
• Broader Go code-generation and gateway parity failures resolved
• Cross-platform CI reviewed

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[drew]

gator-agent

PR Review Status

This is a project-valid, concentrated Windows validation/tooling change. The initial review found one blocking ARM64 dependency-installation issue; the remaining changes have no additional blocking findings.

Action required: @prekshivyas, make the TypeScript install architecture-aware and complete all pinned native dependency setup before parallel validation tasks begin.

Blocking findings:

• GATOR-3f4a651f-01: Native ARM64 TypeScript CI receives an x64-only dependency tree and later mutates it during parallel validation.

Carried findings:

• None

Non-blocking suggestions:

• None

Gator metadata

• Validation: Concentrated Windows SDK/build-validation support with a clear motivation and test path; related to #2050 and distinct from the superseded runtime port in #3326.
• Docs: Fern docs are not needed because this changes contributor validation tooling rather than direct user-facing behavior; relevant testing and architecture documentation is updated.
• Checks: Current-head Branch Checks, Helm Lint, Trivy Changes, and DCO are green.
• E2E: N/A for this validation-tooling-only change.
• Head SHA: 3f4a651fc1ace0c7e89f5eeff737f4ada58078fb
• Base SHA: cc780d4e17512e8f804f68c153c033fe6584ae3a
• Merge base SHA: cc780d4e17512e8f804f68c153c033fe6584ae3a
• Patch ID: 079e94b0410e8593b1b0fb0ddc0ceaae803ddc4b
• Gator payload: 8
• Review mode: initial
• Previous reviewed SHA: none
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:in-review

[github-actions]

Label test:e2e applied for 3f4a651. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[drew]

gator-agent

PR Review Status

Thanks @prekshivyas. I checked the architecture-aware TypeScript installation update against the prior ARM64 finding: all pinned native dependencies are now installed and verified before validation tasks run, and the later node_modules mutation has been removed. No blocking findings remain.

Blocking findings:

• No blocking findings remain

Carried findings:

• None; GATOR-3f4a651f-01 is resolved by this head

Gator metadata

• Validation: Concentrated Windows validation/tooling work related to #2050 and the maintainer-requested upstreaming effort in #3326.
• Docs: Fern docs are not needed because this is contributor validation tooling; the relevant testing and architecture documentation is updated.
• Checks: Required Branch Checks and E2E are running for the current head; Helm Lint, Trivy Changes, DCO, and GPU E2E are green.
• E2E: test:e2e is applied and the current-head E2E workflow is queued/running.
• Head SHA: 42ccd430c5f899a42d8536778e16b5f43527d339
• Base SHA: cc780d4e17512e8f804f68c153c033fe6584ae3a
• Merge base SHA: cc780d4e17512e8f804f68c153c033fe6584ae3a
• Patch ID: f17aa7e884c4d609c46e727c767ac4e562e3005e
• Gator payload: 8
• Review mode: follow_up
• Previous reviewed SHA: 3f4a651fc1ace0c7e89f5eeff737f4ada58078fb
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:watch-pipeline