docs(DEN-1614): publish certified Windows zed develop contract

[ORESoftware]

Linear

• DEN-1614
• Merged implementation: DEN-1616 and DEN-1634
• Canonical Linear contract: zed develop Windows clean-room acceptance contract

Summary

Publishes the completed native Windows extension to the Ubuntu/macOS clean-room contract.

The document defines and records:

• PowerShell command mode as -NoLogo -NoProfile -NonInteractive -Command;
• unchanged interactive PowerShell startup semantics;
• cmd.exe /D /S /C, project-root relative CALL, and explicit ERRORLEVEL propagation;
• canonical project identity versus process-compatible Windows child cwd;
• UTF-16 disk/UNC normalization without lossy Unicode conversion;
• byte-identical alias/canonical managed environments;
• Windows Scripts virtual-environment activation;
• isolated HOME and USERPROFILE without credential copying;
• no dotenv, profile, registry-token, or provider-credential loading;
• bounded writes and failure propagation;
• immutable Windows Server 2022 workflow and evidence policy.

Merged review stack

• CLI implementation PR #100: fd3b3e487b2bdd129dd67403ad51f7299cfe6828
• primary Windows E2E PR docs(DEN-1316): add browser contract architecture and governance #16: 6807fce462b46c421def6b06c5b4050ae9ddf436
• cross-organization release canary PR Fleet rollout: remediate remaining Zed package-pattern findings #43: 72228839933efc933b91d28f3b44bf473458dfac

The CLI merge preserves independent failure-atomic Git-submodule work already on main; the Windows changes are a disjoint conceptual addition rather than a side-selection merge.

Certified evidence

Cross-organization run 30903855437 checked out reviewed E2E source 144d17e28afa9586bc71ec43f340a0e0328a54b4 and merged CLI fd3b3e487b2bdd129dd67403ad51f7299cfe6828 on Windows Server 2022.

It passed:

• 11 imported workflow-policy tests;
• the locked real CLI build;
• 19 native Windows assertions;
• direct scanning of all retained evidence for 11 fake credential canaries;
• clean-checkout proof for the canary, E2E, CLI, and interface repositories.

The report records managed-environment SHA-256 24903e36d446a5dbe15018a7ced801fbbb164ab7ca26149930b58fecfc4d9525, no retained credential canaries, no external registry requirement, and no retained temporary home.

Artifact 8890260522 contains exactly two evidence files, is 1563 bytes, and has ZIP digest sha256:f253e73fe7a3a6c2062b818ce6d45db6b8de9ee5b29fe7c996ddc9631bbaa2dd. The downloaded ZIP was independently scanned again and contained no canary value.

Current head validation

Documentation head 297131b04cd734906c4aab3a50ecce31adad952b changes only the evidence/status text after earlier documentation and policy checks passed on this one-file PR. Final docs CI run 30904462512 and agents-policy run 30904463623 are queued for hosted-runner allocation.

[linear-code]

DEN-1614

DEN-1634