Gate anchored dependency receipts on native Windows and all CI hosts

[Infiland]

Child scope of #844. Depends on #859.

Problem

Modeled race tests cannot prove that retained Windows directory handles, reparse-point rejection, file identities, hard-link publication, and cleanup behave correctly on NTFS. The hardened receipt path must be exercised on every native dependency host before #844 can close.

Scope

• Add native Windows tests for ancestor and output-parent relocation, junction/reparse substitution, existing-target replacement, hard links, long Unicode paths, stage replacement, write-through publication, cleanup, and handle closure.
• Require directory handles without delete sharing for every retained ancestor and pin an existing target while identical bytes are compared.
• Validate Win32 ctypes ABI layouts, disk-file types, file IDs, reparse attributes, and single-link expectations fail closed.
• Add native Linux and macOS receipt creation/idempotence checks, including physical-path handling for macOS /tmp or /var aliases.
• Exercise ordinary bootstrap, dependency-lock, test, and release receipt producers with fresh or byte-identical destinations on their actual CI hosts.
• Document that POSIX parent directory entries are fsynced while Windows file data is flushed and namespace identity is reverified because Python exposes no equivalent retained-directory flush.
• Close Harden dependency receipt publication against filesystem replacement races #844 only after the complete native matrix and ordinary dependency workflows pass on the exact merged commit.

Acceptance criteria

• Real NTFS junction, relocation, hard-link, reparse, replacement, long-path, failure-cleanup, and handle-leak cases pass without mocks as the sole evidence.
• Linux and macOS native tests prove absent publication and byte-identical inode-preserving reuse.
• Every dependency workflow uses a fresh or identical receipt destination and no test still relies on different-content replacement.
• CI rejects skipped, conditionally bypassed, timed-out, or continue-on-error native receipt gates.
• Documentation states exact cross-platform durability guarantees and unsupported-filesystem failure behavior.
• Pyright, Ruff, focused native/workflow tests, and the full unit suite pass.

Non-goals

Do not change dependency versions, lock contents, receipt schemas, or GameMaker/Godot conversion behavior.