Guard retained Windows provider pins against drift

[coneilen]

Summary

Retain the exact public Windows provider sources and prevent the product and investigation pin files from silently diverging. This follows the merged packaging milestone in #378 without changing provider SHAs, build artifacts, or product behavior.

Changes

• Compare the product and terminal-gate pin schemas and every provider field in the existing terminal contract. Values and field names are case-sensitive; missing/additional fields and changed types fail.
• Add isolated fixture coverage for drift in repository, remote URL, SHA, artifact path, and Zig version on either side. JSON property order and explanatory fallback wording may differ.
• Run the new regression suite through the existing terminal-gate validation task and guard that wiring in the validation-runner contract.
• Document the source-retention tags and narrowly scoped provider rulesets below.

Provider retention already applied

Both forks now expose annotated tag graphcode-windows-baseline-2026-09-17:

Provider	Tag object	Peeled pinned commit	Tag / branch rulesets
coneilen/winghostty	1d6a0503178f73884a74f842f60e553f8613efae	f5abc059e4ca58b376eb209313aca7784659c679	23625509 / 23625510
coneilen/zmx	93e424c00c21c5a0313b038db02393e2cedb498e	029e11d2b19162fb3bdf90c8270237d303b8bfb4	23625508 / 23625511

Active tag rulesets prohibit updates/deletion of refs/tags/graphcode-windows-*, with no bypass actors. Active branch rulesets prohibit deletion/non-fast-forward changes to graphcode-host and graphcode-quickchat-hang; normal forward branch development remains allowed.

API readback confirms the exact rules, ref scopes, empty bypass lists, and current_user_can_bypass=never. Anonymous git ls-remote confirms both annotated refs and their peeled commits. No destructive update/deletion probe was attempted. Administrators retain the ability to edit rulesets or repository availability.

These are source-retention tags, not cryptographically signed product releases or immutable archival storage. No installer/binary asset was published, and collaborator permissions were not changed. Public CI source fetches do not require provider credentials. Bootstrap and packaging still resolve exact commit SHAs.

Standalone provider CI caveat

The tag triggered Winghostty's existing push workflow at unchanged f5abc059. Run 35276439353 failed before compilation when bitsadmin could not download the ImGui archive without a Content-Length header (0x80200011); the independent portable-package smoke job passed.

The earlier run at the same pin instead failed because the offline-cache regression forced .zig-global-cache after seeding had populated .zig-cache. These are unresolved provider CI defects, not a green standalone-provider validation claim. This PR neither moves the retention tag/pin nor skips failing provider jobs. GraphCode's host integration gates are separate evidence.

Test plan

RED: pwsh -NoProfile -File Tools\windows\Tests\ProviderPins.Tests.ps1 -> RED: product winghostty.repository drift was accepted before the cross-file comparison was implemented.

GREEN: pwsh -NoProfile -File Tools\windows\Tests\ProviderPins.Tests.ps1 -> Provider pin no-divergence contracts: PASS, covering both-sided drift, missing/extra fields, type changes, schema drift, matching inputs, and reordered properties.

REGRESSION: pwsh -NoProfile -File Tools\windows\validate.ps1 -Task terminal-gate -> real pinned-provider builds, independent/shared attach and restart, persistent history, working-directory checks, destroy/recreate stress, and cleanup pass. TerminalGate.Tests.ps1, ValidationRunner.Tests.ps1, and git diff --check also pass.

Scope

This PR changes validation and documentation only. Provider source pins, native product code, shared Swift/macOS behavior, signing policy, protected GraphCode baseline branches, and required-check definitions are unchanged. Production certificate/publisher policy, release-maintainer arrangements, signed installer/artifact publication, updater install/relaunch, and the live enforcement probes in #374 remain separate.

Hosted evidence

All eight required PR checks pass at 9851d558d686536b38311c389c0379ccb4b0c0c5:

• DCO
• Linux
• macOS
• TDD evidence
• Windows shell
• Windows port / complete validation
• Both deterministic Windows hardening contexts

Current main is an ancestor of this exact head, and the worktree is clean.
No separate full-pinned repeated-real-product dispatch was run for this test/documentation-only change; the previous packaging dispatch remains evidence only for 3b5556e. The standalone Winghostty failures documented above remain unresolved and are not overridden by GraphCode's integration checks.

Checklist

• Contribution guidelines followed and commits DCO-signed.
• Observed RED before adding the comparison.
• Focused and real terminal-gate regressions pass locally.
• Public tag targets and active ruleset configuration verified.
• Required hosted PR checks are green.