[foxnne]

Part of the self-hosted runner work in docs/AGENT_WORK.md ("macOS and Windows provisioning are separate follow-up work", #726). This is the Windows half.

What changes

• scripts/runner-setup.ps1 (PowerShell 5.1+, elevated, -DryRun): same rules as runner-setup.sh. Private-repo check via gh api, the fizzy label, Zig version read from cloud-setup.sh, jj and the Actions runner at pinned or latest releases, deps cache restored into the Zig global cache, FIZZY_BUILD_SLOTS/FIZZY_BUILD_MAX_LOAD in the runner .env. The registration token is taken out of the environment at start and goes only into config.cmd's environment; the service password is random, in memory only.
• A dedicated non-admin local user fizzy-worker; the runner is installed as a Windows service under it. A service has no desktop, so GUI/window tests cannot run on it. I chose the service because it survives reboots with no stored logon or always-logged-in desktop, and the headless gates need no window. The alternative (auto-logon plus a logon task) is documented and not built until a GUI job exists.
• scripts/runner-clean.ps1 plus a daily task FizzyRunnerClean: removes untracked .zig-cache/zig-out/zig-pkg under C:\fizzy\workspaces and actions-runner\_work, vetoed by running zig/zls/Runner.Worker, skips reparse points, requires a tracked-file list. The merged-PR workspace deletion is not ported.
• scripts/test-runner-setup.ps1 + test-runner-setup-windows.sh (skips when pwsh is absent), wired into the lint job in ci.yml (GitHub's Ubuntu images have pwsh).
• Docs: "Self-hosted runner (Windows)" in docs/AGENT_WORK.md: prerequisites, exact elevated commands, reading the token, verifying Online in fizzyedit/work, zig version, one zig build test through the runner.

Verified

Nothing was run. This session had no pwsh and no Windows, so the PowerShell is only statically reviewed, not parsed. The dry-run test is untested here; its first real run is this PR's CI.

The maintainer must verify on the machine

• The scripts parse and -DryRun works in the machine's PowerShell.
• The runner shows Online with label fizzy, and the service runs as fizzy-worker.
• zig version matches cloud-setup.sh; scripts/zb build test passes through the runner.
• The ziglang.org zip URL, the Linux deps archive restored with tar.exe, and config.cmd reading the password from ACTIONS_RUNNER_INPUT_WINDOWSLOGONPASSWORD.
• The S4U scheduled task runs (Start-ScheduledTask FizzyRunnerClean, LastTaskResult 0).
• scripts/zb under Git Bash (symlink slots, no load average).

Review round 1 (medium review)

Fixed: C:\fizzy ACL (inheritance removed, Modify only on runner/workspaces/zig-cache, tools and bin read-only for the worker, icacls exit codes checked); batch-logon right granted and the task run and its result checked at setup; -ExecutionPolicy Bypass everywhere and -DryRun no longer needs a gh login; native calls wrapped for Windows PowerShell 5.1 (CI uses pwsh 7 and cannot see that bug class); rerun after a partial registration (clear and --replace); orphaned-SID-safe admin check; sha256 checks for Zig, runner, jj, zstd, deps cache (refuse unverified Zig/runner); long paths, tar failure now fatal unless FIZZY_RUNNER_DEPS_PARTIAL_OK=1; PATH type preserved, Git bash first in the runner .env PATH, optional Defender exclusion; cleaner dry run creates no lock, links removed individually before deletes.
Still unverified: all of it on real Windows/5.1; secedit rights edit, S4U task, config.cmd env password, tar.exe on the Linux archive, release digest fields (absent means a warning, or refusal for Zig/runner), zb under Git Bash.

Round 3: zstd (no published digest) is pinned to v1.5.7 with its sha256 in the script; Zig (index.json shasum), the Actions runner (asset digest) and jj (asset digest) were checked with gh/curl and do publish digests, so are not pinned.