feat(sidecar): a Windows service, the egg and its launcher, and the first release workflow (phase 18)

Module-rust phase 18, step 4 of docs/modules/rust/PLAN.md §34.2.7.

The Windows service (D149, §34.2.5): src/windows.rs, ported from link's fix
for error 1053. The same exe tries the SCM handshake and falls through to a
console run on 1063; it reports Running only once the listener and store are
up, and logs to a daily file beside its config. One binary serves every
RunicGatewayRust-<id> instance, because the SCM ignores the dispatcher's name
for an own-process service.

An empty environment variable now counts as unset. A Pterodactyl egg exports
every variable it declares, so a blank RUSTLINK_WEB_TOKEN arrived as "" and
overrode the saved token, and a new one was generated and persisted on every
boot. That breaks D152, which this change makes true.

The egg (R20, R22, D151, D152, §34.2.6), in egg/:
- install.sh is egg 18's script with two changes. A wipe guard moves
  rust-link/ to /tmp around `rm -rf ${REMOVE_FILES}`. The bridge block then
  fetches a schema-2 Rust bundle (pinnable by RUNICGATEWAY_BUNDLE), checks
  every asset's sha256 and the plugin's protocol before placing anything, and
  places the plugin by FRAMEWORK. Vanilla installs nothing and does not fail.
- with-sidecar.sh is the launcher. It unsets blank variables, builds the web
  bind from RUSTLINK_WEB_PORT, and runs --print-config so that a newly
  generated token is printed once. It prints the URL and server id for the
  admin page, then execs the game. It no longer uses `set -e`: nothing the
  bridge gets wrong may keep the game from booting.
- The startup's launcher prefix is conditional, so a server with no bridge
  boots exactly as egg 18 does.
- build.sh assembles egg-rust-runicgateway.json. PR Checks runs it.

The release (D145, §34.2.1) reuses servuo-plugins' engine. It publishes the
static musl Linux binary, the Windows exe, the launcher, the egg and
SHA256SUMS, and dispatches the installer's bundle.yml. PR Checks gains a
clippy run for the Windows target.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

.gitea/workflows/pr-checks.yml

@@ -57,7 +57,7 @@ jobs:
           SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo"
           $SUDO apt-get update
           $SUDO apt-get install -y --no-install-recommends \
-            build-essential curl ca-certificates git
+            build-essential curl ca-certificates git jq gcc-mingw-w64-x86-64
 
           if ! command -v cargo >/dev/null 2>&1; then
             curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
@@ -66,6 +66,7 @@ jobs:
           echo "${HOME}/.cargo/bin" >> "$GITHUB_PATH"
           export PATH="${HOME}/.cargo/bin:${PATH}"
           rustup component add rustfmt clippy
+          rustup target add x86_64-pc-windows-gnu
           cargo --version && cargo fmt --version && cargo clippy --version
 
       # Keyed on Cargo.lock: dependency builds are reused until a dep actually
@@ -97,3 +98,20 @@ jobs:
       - name: cargo test
         run: cargo test --locked
 
+      # The Windows service entry point (src/windows.rs) compiles only for
+      # Windows, so the Linux clippy above never sees it. Linted against the
+      # release's own target here, so a service-only fault fails a PR instead
+      # of waiting for a release to show up (docs/modules/rust/PLAN.md §34.2.5).
+      # MinGW is the C compiler for the bundled SQLite, as in release.yml.
+      - name: cargo clippy (Windows target)
+        env:
+          CC_x86_64_pc_windows_gnu: x86_64-w64-mingw32-gcc
+          AR_x86_64_pc_windows_gnu: x86_64-w64-mingw32-ar
+        run: cargo clippy --locked --target x86_64-pc-windows-gnu --all-targets -- -D warnings
+
+      # The egg the release publishes, assembled exactly as release.yml does:
+      # the install script and the launcher parse, and the egg carries the
+      # shape the panel's importer needs and every variable it exists to add.
+      - name: Build the egg
+        working-directory: .
+        run: bash egg/build.sh /tmp/egg-rust-runicgateway.json