feat: secure Windows capture IPC with named pipes

[kev1n77]

Summary

• upgrade capture IPC to protocol 0.6 and activate random local Windows named pipes instead of desktop loopback TCP
• create every pipe with a protected DACL limited to the current user and SYSTEM, reject remote clients, then read back owner and ACEs before accepting the listener
• verify every connection against the launched sidecar PID, rotate one pipe instance per connection, and pre-create the next instance so timed-out overlapped handles are never reused
• add Python named-pipe transport support, real Win32 interoperability tests, old 0.5 bundle rejection, and updated security/progress documentation

Verification

• cargo test -p codeischeap-capture-ipc --all-targets (15 passed)
• cargo clippy -p codeischeap-capture-ipc --all-targets -- -D warnings
• cargo test -p codeischeap-sidecar-runtime --all-targets (16 passed, 1 privileged trust test ignored)
• cargo clippy -p codeischeap-sidecar-runtime --all-targets -- -D warnings
• relevant Rust crate suite and Clippy passed
• python -m unittest discover -s sidecars/mitmproxy/tests -v (27 passed, 2 Unix-only tests skipped on Windows)
• macOS and Linux cross-target capture IPC checks passed
• root and desktop rustfmt, Python compile, and git diff --check passed
• packaged Windows sidecar probe passed with IPC 0.6, HTTP/2, cancellation, backpressure, startup identity, and zero credential canaries

Local environment note

The full workspace and Tauri native build cannot complete on this machine because vendored OpenSSL/SQLCipher requires Perl and the installed Git Perl lacks core modules. The focused crates compile locally; cross-platform CI is the authoritative full native build gate.