feat(agents): port bundled agent lifecycle to Windows

.github/workflows/ci.yml

@@ -102,7 +102,7 @@ jobs:
       - name: Native lint including Windows backend
         run: cargo clippy -p buzz-foundation -p buzz-agent-controller -p buzz-credential-store --locked --all-targets -- -D warnings
       - name: All native package tests
-        run: cargo test -p buzz-foundation -p buzz-agent-controller -p buzz-credential-store --locked
+        run: cargo test -p buzz-foundation -p buzz-agent-controller -p buzz-credential-store --locked --no-fail-fast
 
   measurements:
     if: github.event_name != 'workflow_dispatch'

crates/agent-controller/Cargo.toml

@@ -30,5 +30,8 @@ libc = "0.2"
 security-framework = "3.7"
 nix = { version = "0.31", features = ["user"] }
 
+[target.'cfg(windows)'.dependencies]
+windows-sys = { version = "0.61", features = ["Win32_Foundation", "Win32_Security", "Win32_Storage_FileSystem", "Win32_System_Diagnostics_ToolHelp", "Win32_System_IO", "Win32_System_JobObjects", "Win32_System_Pipes", "Win32_System_SystemServices", "Win32_System_Threading"] }
+
 [target.'cfg(any(target_os = "windows", target_os = "linux"))'.dependencies]
 buzz-credential-store = { path = "../credential-store" }

crates/agent-controller/src/connection.rs

@@ -23,6 +23,10 @@ impl DatabricksSettings {
         Ok(())
     }
 }
+/// The pinned engine keeps non-Unix OAuth tokens in memory only, so neither a
+/// later request nor a worker could reuse a sign-in. Deferred on Windows.
+pub const DATABRICKS_WINDOWS: &str =
+    "Databricks sign-in is not supported on Windows yet. Choose OpenAI for this agent";
 pub fn origin(raw: &str) -> Result<String> {
     if raw.is_empty() {
         return Err("Databricks workspace is not configured. Edit the agent, open Advanced → Model, and set Databricks workspace (HTTPS origin).".into());

crates/agent-controller/src/lib.rs

@@ -19,9 +19,7 @@ mod restart;
 mod runtime;
 mod secret;
 mod store;
-#[cfg(unix)]
 mod supervisor;
-#[cfg(unix)]
 pub use supervisor::dispatch as dispatch_agent_supervisor;
 
 pub use agent_defaults::{AgentDefaultsEdit, AgentDefaultsView};

crates/agent-controller/src/logs.rs

@@ -2,9 +2,7 @@
 use crate::Result;
 use sha2::{Digest, Sha256};
 use std::fs::{File, OpenOptions};
-#[cfg(any(unix, test))]
-use std::io::Write;
-use std::io::{Read, Seek, SeekFrom};
+use std::io::{Read, Seek, SeekFrom, Write};
 use std::path::{Path, PathBuf};
 
 /// Domain-separated proof input; only the native-generated single-use nonce is
@@ -94,12 +92,10 @@ fn open(path: &Path, write: bool) -> std::io::Result<File> {
     Ok(file)
 }
 
-// Only the Unix supervisor writes logs; keep the cross-platform retention tests.
-#[cfg(any(unix, test))]
+// Only the supervisor writes logs.
 pub(crate) struct Writer {
     file: File,
 }
-#[cfg(any(unix, test))]
 impl Writer {
     pub(crate) fn new(path: &Path) -> Result<Self> {
         let file = open(path, true).map_err(|_| "Could not open harness log")?;