feat(sidecar): a Windows service, the egg and its launcher, and the first release workflow (phase 18)

Module-rust phase 18, step 4 of docs/modules/rust/PLAN.md §34.2.7.

The Windows service (D149, §34.2.5): src/windows.rs, ported from link's fix
for error 1053. The same exe tries the SCM handshake and falls through to a
console run on 1063; it reports Running only once the listener and store are
up, and logs to a daily file beside its config. One binary serves every
RunicGatewayRust-<id> instance, because the SCM ignores the dispatcher's name
for an own-process service.

An empty environment variable now counts as unset. A Pterodactyl egg exports
every variable it declares, so a blank RUSTLINK_WEB_TOKEN arrived as "" and
overrode the saved token, and a new one was generated and persisted on every
boot. That breaks D152, which this change makes true.

The egg (R20, R22, D151, D152, §34.2.6), in egg/:
- install.sh is egg 18's script with two changes. A wipe guard moves
  rust-link/ to /tmp around `rm -rf ${REMOVE_FILES}`. The bridge block then
  fetches a schema-2 Rust bundle (pinnable by RUNICGATEWAY_BUNDLE), checks
  every asset's sha256 and the plugin's protocol before placing anything, and
  places the plugin by FRAMEWORK. Vanilla installs nothing and does not fail.
- with-sidecar.sh is the launcher. It unsets blank variables, builds the web
  bind from RUSTLINK_WEB_PORT, and runs --print-config so that a newly
  generated token is printed once. It prints the URL and server id for the
  admin page, then execs the game. It no longer uses `set -e`: nothing the
  bridge gets wrong may keep the game from booting.
- The startup's launcher prefix is conditional, so a server with no bridge
  boots exactly as egg 18 does.
- build.sh assembles egg-rust-runicgateway.json. PR Checks runs it.

The release (D145, §34.2.1) reuses servuo-plugins' engine. It publishes the
static musl Linux binary, the Windows exe, the launcher, the egg and
SHA256SUMS, and dispatches the installer's bundle.yml. PR Checks gains a
clippy run for the Windows target.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

sidecar/README.md

@@ -6,7 +6,9 @@ Configuration reference and endpoint list. For what this component *is*, see the
 ## Configuration
 
 `sidecar.toml`, resolved in this order: `--config <PATH>`, else `$RUSTLINK_CONFIG`, else
-`./sidecar.toml`. Environment variables override the file; the file overrides the defaults.
+`./sidecar.toml`. Environment variables override the file; the file overrides the defaults. **An
+empty or blank variable counts as unset**: a Pterodactyl egg exports every variable it declares, so a
+field left blank arrives as `VAR=""`, and honouring that would erase the saved token on every boot.
 
 | Key | Env | Default | What it is |
 |---|---|---|---|
@@ -42,6 +44,15 @@ Resolves the configuration exactly as a normal start would — writing the file
 token if they are missing — and prints it as JSON on stdout, **including the token in clear text**.
 That is the supported way for an installer to obtain it; the alternative is scraping a log.
 
+## As a Windows service
+
+The same `.exe` runs from a shell or under the Service Control Manager. It tries the SCM handshake
+first and falls through to an ordinary console run when a human started it, so there is no
+`--service` flag to forget. Under the SCM it reports `Running` only once the game listener and the
+store are up, turns a stop request into a clean shutdown, and logs to a daily-rolled
+`rust-link-sidecar.YYYY-MM-DD.log` beside its config (a service has no console). One service per
+game server, each with its own `--config`; the installer names them `RunicGatewayRust-<server id>`.
+
 ## Endpoints
 
 Everything except `/health` requires the token, as `Authorization: Bearer <t>`, `X-Api-Key: <t>`,