ci: add bounded Windows PR canary - #10

Note

Medium Risk
Changes org Unity lock admission, licensed credential gating, and cleanup proof semantics on self-hosted Windows; misconfiguration could waste seats or release locks incorrectly, though the workflow is heavily fail-closed and contract-tested.

Overview
Adds a bounded same-repo PR canary for Windows Unity builds (one smoke leg by default) while keeping the full matrix behind explicit workflow_dispatch full mode and defaulting dispatch to preflight-only.

The Builds - Windows workflow now selects matrix size by event/mode, runs on pull_request to main with concurrency that does not cancel in-progress licensed work, and gates forks, Dependabot, and push to zero licensed legs with an aggregate job that enforces expected skip/success outcomes. Licensed paths add exact PR head checks (hosted and on the runner before/after lock admission), runner preflight, stable runner.name lock identity, lifecycle-aware acquire/release with classifier-driven resource-reason, and build retries only when resourceSafe is true; release cooldown is lowered to 1 second for bounded in-attempt retry.

Validate Community Plugins drops weekly Unity build matrix jobs in favor of a zero-seat registry contract (community-plugin-matrix.mjs) with minimal permissions. Upstream sync copies workflow-credential-policy.mjs alongside the lifecycle verifier so isolated runs satisfy imports.

Generated dist updates versioning to use native git calls for diff logging and version-tag detection instead of sh/grep/head, fixing Windows runner compatibility for semantic versioning during the canary.

^{Reviewed by Cursor Bugbot for commit 02d6f34. Bugbot is set up for automated code reviews on this repo. Configure here.}