AgentPod 078: Define Windows evidence via ETW path

[EfeDurmaz16]

Objective

Complete issue 78 from the AgentPod productization plan: Define Windows evidence via ETW path.

Why This Matters

AgentPod is the primary product surface. This work moves Agentbox from a collection of runtime/control features toward a credible governed execution product with honest provider boundaries.

Scope

• Epic: Epic 8: Windows Native Path
• Area: evidence/windows
• Priority: P2
• Expected PR boundary: ETW receipt design only

Out of scope: fake provider support, broad rewrites unrelated to this issue, or claims not backed by the verification gate.

Acceptance Criteria

• Behavior, documentation, or contract described by the issue exists.
• Tests, smoke checks, or docs validation cover the change where practical.
• Verification gate passes: evidence model can reference ETW events without requiring live ETW ingestion.
• Provider/support level remains honest; descriptor-only and prototype surfaces are not presented as shipped.

Verification

evidence model can reference ETW events without requiring live ETW ingestion.

Suggested PR Boundary

ETW receipt design only

Source

Derived from docs/agentpod-productization-100-issues.md at commit 33d44f8.