Cross-platform scaffold: honest build gates + macOS/Linux plan

[NORTHTEKDevs]

Summary

Ghost runs on Windows 10/11 only today. This PR makes the build system and the user-facing surfaces say that plainly, and lands the implementation plan for the macOS/Linux backends. It changes no Windows behaviour and flips no capability flag — macOS and Linux still report functional: false.

Plan: docs/plans/2026-07-cross-platform-plan.md
Audit it implements: docs/audits/2026-07-honesty-audit.md
Existing capability contract (cited, not duplicated): docs/cross-platform.md

The problem

Seven crates were Windows-locked but didn't declare it: ghost-core, ghost-cache, ghost-session, ghost-cli, ghost-mcp named the windows crate unconditionally, and ghost-intent / ghost-http inherited the lock through their dependencies. cargo build on macOS/Linux produced hundreds of unresolved-import errors instead of an answer, and CI ran on windows-latest only, so nothing proved "compiles on Darwin/Linux" either way.

Build honesty

• Target-gated deps — windows / windows-core moved into [target.'cfg(windows)'.dependencies] in the five crates that name them.
• Crate-root gate + build guard — all seven get #![cfg(windows)] and a six-line build.rs that exits with one sentence off Windows:
  Ghost's ghost-core is Windows-only today; see docs/cross-platform.md
  Both mechanisms are needed: #![cfg(windows)] alone gives libraries a clean empty build but gives the three binaries a bare error[E0601]: main function not found, and a compile_error! alone does not suppress the FFI avalanche from the rest of the file (gating ~60 top-level items in ghost-mcp/src/main.rs is not a small change). The build guard reads the target OS, so cross-checking a Mac target from a Windows box errors correctly too. Rationale is written up in the plan, §4.2.
• default-members — ghost-platform and ghost-ground (verified free of any Win32 dependency). A bare cargo build on macOS/Linux is now green and honest; cargo build --workspace still gives Windows developers everything, and .cargo/config.toml adds build-all / check-all / test-all aliases so that's discoverable.
• CI — new check-macos (macos-latest) and check-linux (ubuntu-latest) jobs running cargo check -p ghost-platform -p ghost-ground and cargo test -p ghost-platform. They deliberately never pass --workspace: the Windows-only crates are expected to fail there, and a red X on an expected failure trains people to ignore CI. Existing Windows jobs and the workspace-wide RUSTFLAGS: -D warnings are untouched.
• Tripwire test — crates/ghost-platform/tests/host_capability_tripwire.rs asserts the host backend reports functional only on Windows, and that the scaffolds advertise no Feature. Turning a platform on now requires editing this test in the same commit.

Surface honesty

Applies exactly the redlines the audit marked S1-a, S1-c, S1-d, S2-a, S3-a, S3-b. S1-b (the tagline) and every technical claim about Windows are untouched.

Item	Change
S1-a	README "Platforms" leads with "Today Ghost runs on Windows 10/11 only"; mac/linux demoted to roadmap wording
S2-a	## Install → ## Install (Windows 10/11), requirement moved out of the tail parenthetical
S1-c	MCP tool count "37 tools" → "20 verbs; legacy tool names stay dispatchable", matching the crate description and CHANGELOG 0.16.0
S3-a	Architecture diagram gains the ghost-platform node
S1-d	docs/comparison.md gains a "Platform coverage" row: Windows only today; mac/linux scaffolded
S3-b	server.json 0.15.1 → 0.16.0 (both fields)

kit/* is unchanged — those are Windows artifacts making no cross-platform claim, and per the plan §10 nothing ships there until macOS is verified on-device.

The plan doc

docs/plans/2026-07-cross-platform-plan.md covers: goals/non-goals (Apple Silicon primary), the current architecture reality crate-by-crate, two refactor options with a pick (Option A — cfg-gate now; Option B — extract ghost-session-core after Mac lands, because the trait should be drawn with two working implementations in hand), concrete deltas, the MacBackend design (AXUIElement discovery, CGEvent input, ScreenCaptureKit capture, the Accessibility + Screen Recording permission model), the LinuxBackend design (AT-SPI, XTest/libei, the spelled-out Wayland-vs-X11 detection branch and its reduced capability set), a ~30-row function-by-function map of GhostSession ↔ Windows ↔ macOS ↔ Linux primitives, the on-device verification checklist that gates functional: true, CI additions, ghost doctor changes (exit code 2 on an unsupported OS; the Mac doctor design), the kit/release plan, and an explicit not-in-scope list.

The headline claim gets the honest treatment it needs: background dispatch is built on Windows posted window messages, which have no exact macOS/Linux equivalent. The plan requires it to be measured across an app set before it appears in any capability list, and says out loud that it may ship as PARTIAL or absent off Windows.

Testing

Verified on Linux with a real toolchain (cargo 1.97.1). Cross-target checks were run from Linux; a Windows host is still the authority for the Windows jobs.

• cargo check (default members) on Linux — green, builds ghost-platform + ghost-ground
• cargo test -p ghost-platform on Linux with RUSTFLAGS="-D warnings" — 7 passed, including both new tripwire tests
• cargo check --workspace on Linux — fails as designed with the intended one-line message; --keep-going confirms all seven guards emit their own sentence and nothing else
• cargo check --workspace --target x86_64-pc-windows-gnu — green for the entire workspace, which is the load-bearing check that the Windows build is unaffected: build guards pass, target-gated deps resolve, #![cfg(windows)] is a no-op
• cargo check -p ghost-platform -p ghost-ground --target aarch64-apple-darwin — green (this is what the new check-macos job runs)
• Cargo.lock unchanged; cargo metadata --filter-platform confirms windows resolves for x86_64-pc-windows-msvc and is absent for aarch64-apple-darwin

Not verified here, and worth a Windows-host eye before merge:

• cargo build --workspace / cargo test --workspace / cargo clippy --workspace on a real windows-latest runner. The cross-check above covers compilation but not linking or the live desktop tests. CI will run these on this PR.
• cargo check --workspace on a real macOS host stops at ring's build script when cross-compiled from Linux (no Darwin C toolchain in the sandbox); on a real Mac the ghost-core guard fires first, as it does natively on Linux.