test: validate OpenCode on Windows Docker (DO NOT MERGE)

.github/qa/opencode-windows-docker-e2e/Dockerfile.windows

@@ -0,0 +1,36 @@
+# escape=`
+FROM mcr.microsoft.com/windows/servercore:ltsc2022@sha256:b841bb042e13a079f68fc82461f15abcefe8063fb9a3072120348252f13a6ce3
+
+SHELL ["powershell.exe", "-NoLogo", "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"]
+
+RUN Invoke-WebRequest `
+      -UseBasicParsing `
+      -Uri 'https://nodejs.org/dist/v24.18.0/node-v24.18.0-win-x64.zip' `
+      -OutFile 'C:\node.zip'; `
+    if ((Get-FileHash -Algorithm SHA256 'C:\node.zip').Hash.ToLowerInvariant() -ne '0ae68406b42d7725661da979b1403ec9926da205c6770827f33aac9d8f26e821') { `
+      throw 'Node archive checksum mismatch' `
+    }; `
+    Expand-Archive -LiteralPath 'C:\node.zip' -DestinationPath 'C:\node-dist'; `
+    Move-Item -LiteralPath 'C:\node-dist\node-v24.18.0-win-x64' -Destination 'C:\node'; `
+    Remove-Item -LiteralPath 'C:\node.zip', 'C:\node-dist' -Recurse -Force
+
+ENV PATH="C:\node;C:\Windows\System32\WindowsPowerShell\v1.0;C:\Windows\System32;C:\Windows"
+
+WORKDIR C:/ftqa
+
+COPY package.json package-lock.json ./
+RUN npm.cmd ci --omit=dev --no-audit --no-fund; `
+    $version = (& 'C:\ftqa\node_modules\opencode-ai\bin\opencode.exe' --version).Trim(); `
+    if ($version -ne '1.18.7') { throw "Unexpected OpenCode version: $version" }
+
+COPY qa-provider.mjs ./
+COPY project ./project
+COPY windows ./windows
+COPY Dockerfile.windows compose.windows.yaml ./
+
+RUN node.exe --check C:\ftqa\qa-provider.mjs; `
+    node.exe --check C:\ftqa\windows\job-launch-wrapper.mjs; `
+    node.exe --check C:\ftqa\windows\windows-harness.mjs; `
+    node.exe C:\ftqa\windows\static-check.mjs
+
+ENTRYPOINT ["powershell.exe", "-NoLogo", "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-File", "C:\\ftqa\\windows\\job-supervisor.ps1"]

.github/qa/opencode-windows-docker-e2e/README.md

@@ -0,0 +1,38 @@
+# One-time OpenCode Windows Docker E2E
+
+This branch-scoped harness exercises OpenCode 1.18.7 on a real Windows
+container kernel. It is test infrastructure only and does not modify First
+Tree product code.
+
+The Windows Server Core LTSC 2022 manifest, Node 24.18.0 archive, npm package,
+and Windows native OpenCode packages are pinned and verified. The runtime
+performs a serial database readiness gate, deterministic concurrent new and
+resume turns in separate workdirs, stdin-only prompts, explicit agent/model
+selection, JSONL terminal validation, and real shell-tool execution against a
+local OpenAI-compatible QA provider.
+
+All runtime OpenCode invocations, including the runtime version probe, are
+admitted through a wrapper assigned to a supervisor-owned nested Job Object
+before execution. The Docker build-time version gate only validates the pinned
+artifact and version; it is not a runtime invocation or Job-admission proof.
+The final tool creates a detached child. The harness stops the OpenCode root,
+confirms the same child remains a Job member, invokes `TerminateJobObject`, and
+requires two empty process-list snapshots 500 ms apart.
+
+Run on a Windows Docker engine:
+
+```powershell
+.\windows\run-windows.ps1
+```
+
+The entrypoint writes machine-readable runtime, runner/engine identity, and
+cleanup receipts. It removes only project containers, networks, and the local
+service image; it does not prune the cached LTSC base image. The one-time
+workflow uploads only an allowlisted evidence set, with provider request
+bodies removed.
+
+Static inspection on any host with Node:
+
+```sh
+node windows/static-check.mjs
+```

.github/qa/opencode-windows-docker-e2e/compose.windows.yaml

@@ -0,0 +1,12 @@
+services:
+  windows-job:
+    build:
+      context: .
+      dockerfile: Dockerfile.windows
+    isolation: ${FTQA_WINDOWS_ISOLATION:-process}
+    environment:
+      FTQA_EVIDENCE_DIR: 'C:\artifacts'
+    volumes:
+      - type: bind
+        source: ${FTQA_EVIDENCE_DIR:?set FTQA_EVIDENCE_DIR to an absolute run-local Windows path}
+        target: 'C:\artifacts'

.github/qa/opencode-windows-docker-e2e/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "first-tree-opencode-cross-platform-qa",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "check:windows-static": "node --check qa-provider.mjs && node --check windows/job-launch-wrapper.mjs && node --check windows/windows-harness.mjs && node windows/static-check.mjs"
+  },
+  "dependencies": {
+    "opencode-ai": "1.18.7"
+  }
+}

.github/qa/opencode-windows-docker-e2e/project/AGENTS.md

@@ -0,0 +1,5 @@
+# OpenCode Windows per-turn CLI QA
+
+PROJECT_AGENTS_MARKER_218A
+
+This is isolated synthetic QA state. Do not access files outside this run root.