Phase 4: kids' Windows computer client (AUD-97)

Adds windows/, the Python client for the kids' Windows computers, and proves
both halves of the Phase 4 definition of done on the real box
(DESKTOP-TE2RHV2).

The client:
- subscribes, retained, to its own config on the 8883 TLS device plane with its
  own broker account (FR-3, FR-6);
- keeps the last valid config on disk and loads it before connecting, so a
  broker outage changes nothing (FR-14);
- terminates every process on the blocklist while the device is effectively
  locked, with the allowlist winning and the client's own tree plus critical
  system processes protected (FR-4, FR-16);
- publishes presence and daily per-app usage; the day's totals are held on disk
  and republished when the link returns (FR-7);
- shows an always-on-top warning window naming what is blocked, why and until
  when (FR-9).

install-scheduled-task.ps1 registers the logon Scheduled Task for the kid's
account with an interactive token, and grants that account Modify on the state
directory: a file created from an elevated shell inherits Administrators only,
and the limited task is otherwise refused with Access denied.

Evidence (windows/EVIDENCE.md, from the machine's own log): notepad.exe killed
inside a scheduled window (pid 16600, then 9724), the device online in the
Control Service with locked/until/reason, a telemetry row for the device
(app=690s), enforcement continuing with the broker unreachable
(192.168.20.13:8884), the warning window on the interactive desktop, and the
Scheduled Task registered at logon as New Comp.

Domains are deliberately not reported: Windows has no cheap per-process DNS
attribution, so the client sends "domains": [] and the gap is documented rather
than guessed.

54 unit tests, run with `make windows-test` (no broker, no Windows, no psutil).

AGENTS.md §11 is now 10 of 10.

Makefile

@@ -13,7 +13,7 @@ MQTT_VERIFY_PORT ?= 18883
 MQTT_IMAGE ?= eclipse-mosquitto:latest
 
 .PHONY: help test vet build up down restart logs ps hash-password deps fmt \
-        mqtt-tls mqtt-verify mqtt-config verify-phase8
+        mqtt-tls mqtt-verify mqtt-config verify-phase8 verify-phase9 windows-test
 
 help:
 	@echo "make test           run go test ./... in golang:1.25-alpine"
@@ -28,6 +28,7 @@ help:
 	@echo "make mqtt-tls       generate the lab CA and broker certificate"
 	@echo "make mqtt-config    build the scratch broker config in deploy/mosquitto/build/"
 	@echo "make mqtt-verify    prove TLS + credentials + topic ACLs on a scratch broker"
+	@echo "make windows-test   run the kids' Windows client unit tests (python -m unittest)"
 	@echo "make verify-phase8  prove an API lock reaches a device in under a second"
 	@echo "make verify-phase9  prove the Hub answers and the Apprise alerts deliver"
 
@@ -79,6 +80,11 @@ mqtt-verify: mqtt-config
 	MQTT_VERIFY_PORT=$(MQTT_VERIFY_PORT) MQTT_IMAGE=$(MQTT_IMAGE) \
 	  deploy/mosquitto/verify-isolation.sh
 
+# --- Windows client (Phase 4) ------------------------------------------
+# Pure logic only: no broker, no Windows, and no psutil needed.
+windows-test:
+	cd windows && python3 -m unittest discover -s tests -t .
+
 # Phase 8 definition of done: lock through the admin API, measured until a real
 # broker subscriber receives the retained config. Never touches the 1883 plane.
 verify-phase8: