Harden installer and Windows service lifecycle

[wellivea1]

What changed

• Hardened the Windows installer, updater, uninstaller, Android builder, and server installer with pinned tool validation, cross-process lifecycle locking, ownership checks, transactional publication, rollback, and fail-closed safety gates.
• Added native Windows service execution, readiness and graceful shutdown handling, bounded log rotation, strict config validation, restricted server-root handling, durable secret publication, and ownership-aware firewall management.
• Made sleep-data export read observations and corrections from one SQLite snapshot while preserving real hard deletion as distinct from append-only suppression.
• Added environment-backed Android release signing and expanded Windows/Android CI coverage.
• Reworked install/update, self-hosting, and portal design documentation so the stated guarantees match the implementation and Phase 4 roadmap constraints.

Why

The initial installer/server slice had multiple correctness and feature-design gaps: partially published binaries could leave mixed releases, similarly named foreign services/firewall rules/shortcuts could be modified, unsafe or reparse-point server roots could receive recursive ACL replacement, and the Windows daemon did not implement a real SCM lifecycle. Export also assembled related tables outside one read snapshot. These changes make those boundaries transactional, ownership-aware, and testable.

Validation

• Go test and vet: core, desktop, server (Windows), and tools
• Desktop frontend: 213 tests; trusted frontend: 6 tests; lint, typecheck, production builds, UI standards, and contract fixtures
• Android: unit tests, lint, debug assembly, APK signature verification, emulator install and launch
• Wails production desktop build and both server executable builds
• Installer: 30 regression tests, PowerShell parser checks, and full install/update/Android/server/uninstall dry-run matrix
• git diff --check and git fsck --full --no-reflogs