winlogbeat: replace Python system tests with Go testscript tests

[andrewkroh]

Proposed commit message

Delete the Python-based system test suite (tests/system/) and replace it
with pure Go tests using rogpeppe/go-internal/testscript. There is no
more Python in Winlogbeat's test infrastructure.

The new test suite lives in winlogbeat/tests/testscript/ with txtar
scripts organized into subdirectories: export/ (cross-platform),
config/ (Windows), eventlog/ (Windows), and evtx/ (Windows). Each
subdirectory runs as a subtest for targeted execution.

Test commands implemented for txtar scripts:
- write-event, write-multiline-event, clear-event-log: event log setup
- check-event-count, check-event-field, check-event-field-exists,
  check-event-field-absent, check-event-field-contains: assertions
- wait-for-event-count: polling for async event delivery
- envsubst, sleep: utilities

The write-event command defaults to the current process user's SID,
matching the Python write_event_log() behavior, so that user identity
fields (winlog.user.*) are present in events and testable.

While developing these tests, we identified and fixed a bug in
runner.go where io.EOF from no_more_events: stop was checked after
the backoff handler rather than before it. Since IsRecoverable()
returns true for io.EOF, this caused infinite retries and silently
dropped the final batch of events returned alongside the EOF. This
turned out to be the same issue reported in #47388. An evtx test
(read_all_events.txtar) reads sysmon-9.01.evtx with batch_read_size=5,
forcing 7 Read() calls where the final call returns 2 records with
io.EOF, proving the fix end-to-end.

Additional changes:
- Remove Python mage targets from winlogbeat and x-pack/winlogbeat
- Simplify make.bat to use 'go run' for mage
- Remove TestSystem from main_test.go

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works. Where relevant, I have used the stresstest.sh script to run them under stress conditions and race detector to verify their stability.
• I have added an entry in ./changelog/fragments using the changelog tool.

How to test this PR locally

cd winlogbeat
.\make.bat unitTest

Related issues

• Fixes [winlogbeat] when ingesting evtx file processing stops at 512 #47388

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)