feat(runtime): support Windows OpenSandbox guests

[zpzjzj]

Summary

• add typed OpenSandbox platform and optional resources configuration with Windows guest defaults and user overrides
• route workspace setup, transfers, Custom Engine execution, PowerShell script judging, and artifact collection through guest-OS path and shell semantics
• replace the lifecycle compatibility implementation with the official Go SDK create path
• add bilingual documentation plus an opt-in Extended CI job that runs a deterministic real Windows guest lifecycle

Compatibility

Omitting environment.platform and environment.resources preserves the existing Linux behavior. Built-in Agent CLI bootstrap inside Windows guests remains out of scope (tracked by #48); preinstalled CLIs and Custom Engines are supported.

Validation

• make verify
• go test -race ./internal/config ./internal/agent ./internal/judge ./internal/evaluator
• go test -race ./internal/runtime -skip TestNoneRuntime_ExecTerminatesGracefullyThenEscalates
• go test -tags e2e ./e2e -run "TestCustomEngine_OpenSandboxWindowsGuest|TestPipeline_CustomEngine_LocalTransport" -count=1
• Windows fixture validation runs without infrastructure; the real guest run is gated by the Extended CI windows_guest workflow input and requires KVM/TUN/Docker

make test also exercised the full suite, but the existing 300 ms SIGTERM timing test TestNoneRuntime_ExecTerminatesGracefullyThenEscalates intermittently missed its trap under the race run. A subsequent runtime race run excluding only that known flaky passed. The local full quick E2E run additionally hit a broken machine-local Codex install (spawn .../codex ENOENT); the targeted Custom Engine E2E passed.

Closes #45

[zpzjzj]

Extended CI follow-up: https://github.com/alibaba/skill-up/actions/runs/29551950851

• Linux OpenSandbox E2E passed after isolating the Windows server on port 8081.
• none-runtime full E2E, Windows-host quick E2E, Docker E2E/full-LLM, and GoReleaser checks passed.
• The real OpenSandbox Windows guest lifecycle was not executed: the selected runner reported /dev/kvm as unavailable or not readable/writable, so the gated steps were skipped. A KVM-capable runner is still required for end-to-end Windows guest validation.