Release v0.12.0: Windows registry grammar, views, and process trees

[uk-bolly]

Description of change

This is v0.12.0, and it is the release where Windows stops being the platform
you write specs around.

v0.11.0 made Windows honest: checks that could not run stopped quietly claiming
success. This one makes it capable. Three pieces of work land together, all of
them things an operator writing a hardening spec hits within the first hour.

Registry paths now look like the ones you copied. regedit's address bar
gives you HKEY_LOCAL_MACHINE\... and Get-ItemProperty gives you HKLM:\...,
and until now syver accepted neither, so every path had to be hand-edited into
the short form first. All the spellings work, in any case. Alongside that,
type: understands the full REG_* set rather than the common six, and there
is a new view: attribute for choosing the 32-bit or 64-bit registry view: on
64-bit Windows some keys exist twice, and a spec previously had no way to say
which copy it meant. It got whichever syver's own architecture happened to see.

There is also a small diagnostic that matters more than its size. Ask about
...\ProfileList and you are asking about a value; ask about
...\ProfileList\ and you are asking about the key. Both answer truthfully,
and an author who means the second and writes the first gets exists: false,
which passes. Syver still refuses to guess which you meant, because guessing
moves the ambiguity somewhere you cannot see it, but it now tells you when the
two are confusable.

Timed-out commands no longer leave processes behind on Windows. command:
runs through cmd /c, so the thing syver starts is a shell and the thing that
actually hangs is the shell's child. Killing the shell alone left that child
running, which made the leak the normal case rather than an edge one. The
process now runs inside a Job Object and the whole tree goes with it. Worth
saying plainly, because the docs claimed the reverse: this makes Windows
stronger than Linux and macOS here, where a process that calls setsid
escapes the process group and survives. A command that succeeds is never
touched, so a check that deliberately starts a background service still leaves
it running.

And a cluster of Windows correctness fixes carried over from the wave2
branch: mount: says it is unsupported instead of blaming your mountpoint,
process: status errors rather than returning an empty list with no error,
absolute C:\... and UNC gossfile includes resolve, ~\Documents\x expands,
and autoadd both honours --log-level and tells you when it skipped
something it could not read.

Riding along is the container work that had been sitting on devel under an
unreleased 0.11.3 heading: the published image finally has a description on its
package page, three documentation pages that existed but were unreachable are
now linked, and the integration fixtures assert assertion counts rather than
just exit codes.

Why this is a minor rather than a patch

view: is a new attribute, and the resource layer is deliberately
cross-platform, so it appears in docs/schema.yaml on every platform whether or
not that platform can honour it. That makes it user-facing spec syntax, and spec
syntax does not change under a patch. It is the only new attribute here.

How much of this was actually tested

More than usual, and it is worth being specific because Windows claims in this
project have been thin before.

Everything was exercised on two independent Windows images, a Server 2025 guest
and a Windows 11 host, rather than merely cross-compiled. The registry fixture
gives an identical Count: 20, Failed: 0, Skipped: 3 on both. view: was
proven to genuinely read different data by writing one key through each WOW64
view with different values and reading both back through the shipped binary, so
an implementation that accepted the attribute and ignored it would fail.

It was also run against a real benchmark: ansible-lockdown/Windows11-CIS-Audit
at v3.0.0, 540 check files, which uses syver and gates on its version. That
produced 1389 assertions, with every failure traceable to genuine host state.