feat(mxc): migrate Windows driver to schema 1.0.0

[shailendra-nv]

Summary

• Migrate the Windows MXC driver from schema 0.8.0 to the stable 1.0.0 contract used by MXC 1.0.0 RC3.
• Adopt the RC3 lifecycle CLI (--operation and --container-id) and remove retired JSON routing/configuration fields.
• Update live probes, integration coverage, architecture guidance, and gateway configuration documentation.

Related Issue

No issue required: this is a targeted MXC dependency/schema compatibility migration requested directly for the Windows branch.

Changes

• Emit the MXC 1.0.0 directional network, ProcessContainer, and IsolationSession shapes.
• Route IsolationSession provision/start/exec/stop/deprovision through RC3 CLI arguments and layer execution environment variables over the default user environment.
• Continue accepting the retired default_configuration_id gateway setting as a documented no-op for configuration compatibility.
• Gate governed-egress live tests on RC3's baseContainerSupportsIngressHostLoopbackAllow probe capability, while continuing to execute ordinary ProcessContainer coverage on fallback tiers.
• Report isolation tier and host-loopback capability in probe-mxc-host.ps1 and document the operational constraint.

Testing

Host	Validation	Result
Local Windows ARM64, MXC RC3	windows:check:arm64	Passed
Local Windows ARM64, MXC RC3	windows:lint:arm64	Passed
Local Windows ARM64, MXC RC3	windows:build:arm64	Passed
Local Windows ARM64, MXC RC3	windows:test:arm64	5,044 passed, 0 failed, 27 skipped
Local Windows ARM64, MXC RC3	windows:test:unsupported:arm64	10 selected assertions passed
Local Windows ARM64, MXC RC3	windows:test:mxc-real:arm64	13 passed, 0 failed, 1 filtered; all RC3 schema/lifecycle and governed-egress scenarios executed
Colossus Windows x64, MXC RC3	mise run pre-commit	Passed
Colossus Windows x64, MXC RC3	windows:check:x64	Passed
Colossus Windows x64, MXC RC3	windows:test:x64	5,044 passed, 0 failed, 27 skipped
Colossus Windows x64, MXC RC3	windows:test:unsupported:x64	10 selected assertions passed
Colossus Windows x64, MXC RC3	windows:test:mxc-real:x64	13 passed, 0 failed, 1 filtered; 4 entries self-skipped with explicit RC3 host-capability reasons
Colossus Windows x64, MXC RC3	release build	Rust release compilation passed; final Z3 runtime staging is blocked by the machine's static-only Z3 cache, and bundled-Z3 download is blocked with HTTP 403

Colossus now runs wxc-exec.exe ProductVersion 1.0.0+3cddcbc2 (SHA-256 8A6D1DB4DD1846981127D9014741BE18B094D07BE967765DFF6754BDA1D40259, valid Authenticode signature). Its previous 0.8.0 installation is preserved at C:\mxc-backup-0.8.0-20261006-1055.

The RC3 probe selects appcontainer-dacl on Colossus: basic ProcessContainer is live, while IsolationSession and ingress.hostLoopback=allow are unavailable on that Windows host. The live suite now reports those constraints instead of treating them as schema failures.

The local ARM64 pre-commit hook cannot build grpcio-tools 1.78.0 from source under Windows ARM64/Python 3.14 because MSVC receives incompatible /std:c++17 and /std:c11 flags. The complete pre-commit suite passed on Colossus x64.

Checklist

• Tests cover the 1.0.0 schema and RC3 lifecycle contract.
• Local ARM64 and Colossus x64 validation completed.
• Architecture and published configuration documentation updated.
• Commits use Conventional Commits and include DCO sign-off.
• No secrets or credentials added.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.