feat(settings): add Windows kernel tools integration

[FreddyJD]

Summary

• add an opt-in Windows Kernel Tools section to Settings
• clone and build roxy-gg/kernel-tools at pinned revision 2f51a1d5981a553d7642db9c81d41a002f3c44e4
• manage Windows test signing and the demand-start AIBridge driver through explicit UAC prompts
• keep MCP agent access disabled until separately confirmed, with disable/uninstall controls
• expose typed main/preload IPC contracts and localized warning/confirmation UI
• install the driver and MCP bridge under %ProgramFiles%\Roxy\KernelTools and verify copied binaries by SHA-256

Safety

• nothing installs, starts, or registers automatically
• agent access requires a separate confirmation and an elevated Roxy process because the driver rejects unelevated clients
• uninstall removes only matching Kernel Tools MCP registrations and can optionally disable test signing
• the external checkout is detached at the pinned reviewed commit

Validation

• npm run build
• npm run typecheck
• npm run smoke:kernel
• npm run smoke:shared (1085 checks)
• npm run smoke:i18n (18 checks)
• desktop and confirmation-state visual inspection with the real component and production CSS
• git diff --check

Local driver-build note

The desktop integration and production app build pass. A real external driver compile could not complete on this workstation because Visual Studio's WDK integration is missing:

error MSB8020: The build tools for WindowsKernelModeDriver10.0
(Platform Toolset = 'WindowsKernelModeDriver10.0') cannot be found.

The pinned dependency revision exists on kernel-tools/main and is titled fix: make kernel bridge buildable and constrained.

[FreddyJD]

Security review status

Do not install this on a primary workstation yet. A source audit of the pinned kernel-tools revision found blocking issues in the external driver/bridge, including an unsigned driver build, kernel-crash risks in directory enumeration and fixed-size string handling, and unrestricted elevated operations over process memory, protected files, registry values, and process termination.

The desktop integration now fails closed before any UAC or test-signing change when the built driver lacks a valid embedded signature. The external driver still requires remediation and isolated-VM validation before this PR should be considered install-ready.