[rteoo]

Summary

• Add a Windows preparation helper with strict tag/version and clean origin/main guards, local native gates, artifact hashing, and documented signing/publication limits.
• Fix the existing widening-test race: finish_scan now waits for the active scan to end as well as requiring a tree. Widening intentionally keeps the old tree visible, so tree presence alone could return early on slower runners.
• Preserve the existing reuse, root, selection, and file-table assertions; production code and CI configuration are unchanged by this repair.

Testing

• Windows release helper: PowerShell parsing and seven fake-command scenarios previously passed.
• Rust formatting and Git whitespace checks passed for the CI repair.
• Native Windows focused widening regression passed. cargo xtask lint passed; cargo xtask test passed 201 tests with one existing ignored test. Git whitespace checks passed.
• All six hosted platform jobs passed for repair commit ec5d2a2, including macOS x86_64, in run 37016905000.
• Original failing job: 37004918474 / macOS x86_64.
• Native installer preparation and signing were not exercised. No release tag, upload, or deployment was performed.

Risks

• Signing and other platform release gates retain their native hosts and existing GitHub workflow.
• Artifact preparation requires the preinstalled native toolchain and documented compliance inputs.