Support safe atomic project creation on Windows #134

PR #96 deliberately fails closed on Windows because its current publication contract depends on POSIX directory descriptors, flock, directory fsync, and atomic no-replace rename.

Implement the same contract with Windows-native primitives rather than weakening it:

• bind every parent component by handle and reject symlinks, junctions, and other reparse-point traversal
• retain and reverify parent/stage identity and ownership through publication
• serialize creators, stage and byte-verify the complete tree, and publish without replacing an existing target
• distinguish preserved-stage, published, and commit-uncertain outcomes across interruption and cleanup failures
• keep the existing JSON/error-code contract and never silently fall back to a race-prone path implementation

Acceptance: the Windows CI job should run autoform project new successfully for the bundled release and cover existing targets, concurrent creators, parent replacement/reparse points, interruption, and no-replace publication.

Follow-up to #96.