[Haoming9527]

Refs #872 and #932. Stacked on #931; this Windows-first handoff does not close the full issue.

What was wrong

The qualified Windows session runtime existed only in a local adoption checkout whose runtime download pin pointed to an unpublished asset. Adopting that pin would break clean installs and CI until a separate publication decision.

The change

Record the complete candidate inventory as review data and its exact qualified digest in the existing session-publication gate. The gate retains the same digest membership check used by qualified adoption commit 511f9920044c1aa38d7ca8443e1a6e26f7bc61c5.

The published stock manifest, download URL, defaults and CI workflow remain unchanged. Stock remains ineligible for session publication; selecting the qualified candidate requires a separate pin adoption after publication. The candidate fixture has no download URL. No runtime assets, release tags or binaries are published by this PR.

Tests distinguish the qualified inventory from the stock inventory and a mutated executable inventory, and retain the production refusal without a user bypass. Bilingual references explain the inactive candidate and link the separate Windows qualification handoff. No dependencies or model schema changed.

Validation

• npm run build: passed.
• node test/run.mjs persistent-mode niubash-payload: 20 checks passed across two suites, zero failures; one payload integration suite skipped because this isolated review checkout has no staged runtime. This is not a full-gate result.
• node scripts/check-file-size.mjs: 947 tracked code files passed the 1,000-line limit. git diff --check passed.
• Stock payload manifest and CI workflow were compared with the green parent and remain byte-identical.
• Separately, exact local adoption 511f992 passed 739 Rust tests and 263 JavaScript suites with four permitted platform skips, all 13 gate steps, and the four-CLI lifecycle probe for 310 seconds: 61 events, 53 process identities, zero survivors. Those receipts qualify the unpublished candidate checkout; they are not a claim that this new PR head ran that full gate.
• Existing prerequisite PRs fix(runtime): scope file admission and preserve Windows lock contention #926 and fix(shell): disclose joined resets after cancellation #927 have successful PR-triggered CI. Current PR-triggered CI: run43554104077, exact head 06c22a65b93e89d3a452724dc0a2e813f6b80af9; in progress, aggregate CI required pending. No performance acceptance is claimed. Linux qualification remains deferred; Windows outer-startup-window exclusions remain documented.

Environment

Windows x64, Node 26.12.1, locked dependencies. This isolated branch is based on PR #931 documentation head d84b884a, with the prior Windows CI fix included. The frozen qualified adoption checkout and artifacts remain unchanged. Runtime publication and merging are separate decisions.