ci(windows): exercise MXC inference demos with mock API

[prekshivyas]

Summary

Runs both shipped MXC inference demos end to end in hosted Windows CI using the real gateway and CLI, the in-process MXC mock, and one local API stub. The lane covers Ollama and cloud-inference wiring on x64 and ARM64 while explicitly making no claim of real MXC or AppContainer enforcement.

Related Issue

Related to #2050. Complements #3769, which adds the broader Windows control-plane conformance lane.

Changes

• Keep the existing Ollama mock flow and extend the harness/stub to run run-inference-test.ps1 with a synthetic sandbox-scoped credential.
• Make the in-process wxc mock launch children with exactly MxcProcess.env, matching the real exec contract and preventing host-environment inheritance.
• Require exactly two /api/tags GETs (host prerequisite plus sandbox workload), one /api/generate POST, and one authenticated /v1/chat/completions POST.
• Run the paired examples after release builds in opt-in PR and main/manual Windows jobs for x64 and ARM64.
• Update task entries, drift guards, Windows architecture docs, and the contributor skill that defines the CI contract.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated

Validated locally on native Windows ARM64 at 442d6f0f:

• mise run --skip-tools windows:lint:arm64: PASS
• mise run --skip-tools windows:build:arm64: PASS
• cargo test --target aarch64-pc-windows-msvc -p openshell-driver-mxc mock_exec_uses_only_the_mxc_process_environment: 1 passed
• cargo test --target aarch64-pc-windows-msvc -p openshell-driver-mxc --test demo_examples: 5 passed
• mise run --skip-tools windows:e2e:mxc:inference-mock:arm64: PASS for both demos
• Request ledger: two GET /api/tags, one POST /api/generate, one authenticated POST /v1/chat/completions
• mise run --skip-tools windows:test:arm64: 5,020/5,021 passed; one unrelated DNS test hit a transient Windows UDP bind denial (os error 10013) and passed immediately when rerun alone
• cargo fmt --all -- --check, git diff --check, PowerShell parser checks, and mise run --skip-tools markdown:lint: PASS

The hosted matrix will provide the corresponding x64 result and rerun the full ARM64 suite.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated

[prekshivyas]

@elezar CI note: this PR changes the Windows lane, but the author account cannot apply repository labels. Please add the test:windows label so the hosted x64 and ARM64 jobs exercise the new demo path. Native ARM64 end-to-end evidence is included in the PR description.

[shailendra-nv]

Requesting changes for two blocking coverage gaps:

1. The harness can report /api/tags coverage even if the sandbox workload stops making that request, because the host-side prerequisite check already records the same GET.
2. This changes the Windows CI/task contract without updating the contributor skill that documents and validates that contract.

The currently executed checks are green, but the Windows MSVC matrix jobs that exercise this path were skipped by the test:windows gate.

[prekshivyas]

@shailendra-nv The two requested changes are addressed in 442d6f0f and both threads are resolved. The harness now requires the exact 2+1+1 request ledger, and the Windows contributor skill documents the new task/workflow contract. Native ARM64 build, Clippy, both demo E2Es, focused regressions, and 5,020/5,021 workspace tests passed; the remaining DNS test hit a transient UDP bind denial and passed on immediate isolated rerun. Please re-review and add the test:windows label so the hosted x64/ARM64 matrix runs; the PR author token is not permitted to request your review or apply that label directly.

[prekshivyas]

@shailendra-nv Fixed the hosted Windows regression in 80d9f869.

Root cause: env_clear() correctly stopped arbitrary host-environment inheritance, but the curated Windows bootstrap environment supplied PATH without PATHEXT. As a result, cmd.exe could not resolve bare system commands such as powershell to powershell.exe. The fix adds only non-secret PATHEXT to the existing curated bootstrap set; it does not restore the full host environment or credential leakage.

Native ARM64 qualification:

• both previously failing lifecycle tests: PASS;
• mock_exec_uses_only_the_mxc_process_environment: PASS;
• complete Windows workspace suite: 5,021 passed, 0 failed, 29 skipped;
• focused Clippy, Rust formatting, Markdown, SPDX, and diff checks: PASS.

The labeled x64 and ARM64 hosted lanes are rerunning on this commit. Please re-review once they are green.