feat: add independent Windows WeChat vault

[zhouzheseno-collab]

Summary

• add an independent Windows counterpart to yichen-wechat-local-vault while preserving its command-level concepts and usage model
• add finite, exact-version Weixin key capture for one explicitly selected process, page-HMAC verification, Windows DPAPI storage, and snapshot-based incremental decryption
• add read-only Windows WeChat 4.x adapters for sessions, unread messages, contacts, group members, history, search, statistics, exports, Favorites, Moments, digest-source packs, and message-resource metadata
• add provenance, privacy, compatibility, dependency/license records, synthetic fixtures, and a Windows CI workflow

Independence and safety

• no source, implementation details, binary, package, fork, mirror, or runtime dependency from wx-cli, wxcli, jackwener, or related projects
• no code reused from the previously closed Windows v0.1/v0.3 contribution
• Mac Skill used only as the same-repository functional/interface reference
• Windows internals implemented independently from the local PE image plus official OpenSSL, SQLCipher, and Frida documentation
• live WeChat databases remain read-only; users must provide the database path explicitly
• unknown DLL hashes or prologues fail closed; verified keys are stored only with current-user DPAPI
• no persistent hook, watcher, service, scheduled task, or automatic Codex/Hermes/MCP configuration change

Verification

• 13 passed synthetic tests on Windows
• Skill Creator validation: Skill is valid!
• dependency self-test and pip check: passed
• PowerShell syntax and compatibility-profile JSON validation: passed
• real decrypted-vault read-only checks passed for 27 databases / 9 message shards, including sessions, unread, contacts, history, statistics, Favorites, Moments, and resource-index queries; no private row content was emitted
• the exact local DLL profile completed real attach/prologue verification/detach in two finite capture windows; the already-running client made no new PBKDF2 call during those windows, so the live run correctly reported zero candidates
• synthetic capture tests cover candidate receipt, SQLCipher HMAC acceptance, DPAPI-at-rest behavior, decryption, tamper rejection, and incremental refresh
• staged-source audit found zero blob hashes shared with the prior Windows branch and no committed keys, databases, logs, account identifiers, or personal absolute paths

This supersedes the closed PR #11 with a new clean implementation and branch.