test: add staged driver validation

[FreddyJD]

Summary

• harden all eight driver IOCTL buffer contracts and registry-read boundary handling
• validate driver response lengths and padded wire structures in the Rust bridge
• add an elevated staged validation harness for repeated load/unload, raw malformed-input coverage, direct bridge testing, crash-dump collection, cleanup, and hash-bound MCP eligibility
• validate the PowerShell harness syntax in CI and document the isolated-machine workflow

Validation

• cargo fmt --manifest-path bridge/Cargo.toml -- --check
• cargo test --manifest-path bridge/Cargo.toml --locked (9 passed)
• cargo clippy --manifest-path bridge/Cargo.toml --locked --bin roxy-kernel-bridge -- -D warnings
• cargo build --manifest-path bridge/Cargo.toml --locked --release
• Windows PowerShell parser check for tests/staged-validation.ps1
• git diff --check
• two independent read-only code reviews, final review reported no findings

Privileged validation status

The live load/unload and raw IOCTL matrix were not run on this workstation. Its WDK Visual Studio integration is missing, test-signing is off, and enabling test-signing requires an elevated boot configuration change and reboot. The harness is included so this stage can run on an isolated, rebootable Windows test machine before MCP agent access is enabled.