fix: prevent Windows Mudlet provisioning recursion

[twilightsaurus]

Summary

Fix the Windows first-launch crash caused by Mudlet helper provisioning recursively copying its own staging directory.

The published v0.3.1 Windows build installs the bundled Mudlet resource at the same path used for writable Mudlet state:

• bundled source: %LOCALAPPDATA%\Imp\mudlet
• writable destination: %LOCALAPPDATA%\Imp\mudlet

On startup, provisioning creates .staging-* beneath that directory and recursively copies the source into it. The copy then encounters its own staging directory repeatedly until imp-desktop.exe terminates with STATUS_STACK_OVERFLOW (0xC00000FD).

Fix

• Rename the bundled Tauri resource from mudlet/ to mudlet-bundle/.
• Keep the existing writable/public Mudlet path unchanged at <local_data>/Imp/mudlet.
• Add a fail-closed overlap guard to prevent provisioning when source and destination overlap or contain one another.
• Harden path resolution for symlinks, Windows canonical/verbatim paths, case differences, and unresolved .. components.
• Preserve existing versioned helper provisioning, repair, and upgrade behavior.

Regression coverage

Adds tests for:

• the exact released source/destination collision;
• destination beneath source;
• source beneath destination;
• normalized .. aliases;
• Unix symlink aliases;
• .. after a missing component;
• Windows case/separator aliases;
• Windows \\?\ canonical source vs ordinary path;
• filesystem immutability on rejected provisioning;
• normal disjoint provisioning;
• agreement between RESOURCE_DIR and the Tauri resource mapping.

Installed first-launch check

Adds scripts/test-installed-first-launch.ps1 to the Windows Build workflow.

The check:

• requires a fresh Imp install/profile;
• refuses existing Imp settings, WebView state, installation state, or a running desktop;
• installs the actual NSIS artifact;
• launches the installed desktop;
• requires it to remain alive for 15 seconds;
• verifies the versioned Mudlet helper, runtime, Imp.mpackage, and current.txt;
• rejects leftover .staging-* directories;
• reports native crash exit codes such as 0xC00000FD;
• has a 10-minute CI timeout.

The published v0.3.1 installer reproduces the stack-overflow failure. A branch-built installer has previously started successfully and provisioned the helper.

Validation

• npm run check — PASS
• git diff --check — clean
• Linux desktop crate — 73 passed, 1 ignored
• Mudlet Rust tests — 11/11 passed
• Windows Rust tests with runtime acceptance — 74 passed
• Windows runtime-acceptance suites — PASS
• NSIS build — PASS
• PowerShell parser — clean
• focused early-crash test reports Installed desktop exited with 0xC00000FD

Merge gate

Do not merge unless the PR's Windows Build job passes, including the installed first-launch check on the fresh GitHub-hosted Windows runner.

The fresh-runner execution is the remaining acceptance gate for this remediation.

Scope

No changes to Direct WSS, gateway authentication, relay/feed, actions, SSH, native runtime ownership, PyInstaller, Caddy/TLS, version numbers, semantic-release, or release.yml.