ci: build Windows agent natively on Pluto runner (drop mingw cross-compile)

The build-agent job (build-and-test.yml) and a new build-agent-windows job (release.yml)
now run on the windows-msvc Gitea Actions runner on Pluto, building native
x86_64-pc-windows-msvc with crt-static. release.yml hands the unsigned guruconnect.exe to
the Linux job, which signs it with Azure Trusted Signing (jsign). Removes the fragile
mingw/GNU cross-compile. Reviewed by Code Review Agent (approve-with-nits).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/build-and-test.yml

@@ -81,48 +81,45 @@ jobs:
 
   build-agent:
     name: Build Agent (Windows)
-    runs-on: ubuntu-latest
+    # Native build on the Pluto Gitea Actions runner (host-mode, Windows Server 2019).
+    # The MSVC toolchain (x86_64-pc-windows-msvc target + crt-static via .cargo/config.toml)
+    # is pre-installed under the Administrator profile; the runner itself runs as SYSTEM, so
+    # the job points CARGO_HOME/RUSTUP_HOME at the Administrator homes.
+    runs-on: windows-msvc
+    env:
+      CARGO_HOME: C:\Users\Administrator\.cargo
+      RUSTUP_HOME: C:\Users\Administrator\.rustup
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Install Rust toolchain
-        uses: actions-rs/toolchain@v1
-        with:
-          toolchain: stable
-          # Single source of truth for the Windows target used by the build below.
-          target: x86_64-pc-windows-gnu
-          override: true
-
-      - name: Install cross-compilation tools
+      - name: Add cargo bin to PATH
+        shell: pwsh
         run: |
-          sudo apt-get update
-          sudo apt-get install -y mingw-w64
+          # Make cargo/rustc from the Administrator toolchain visible to later steps.
+          "C:\Users\Administrator\.cargo\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
 
-      - name: Cache Cargo dependencies
-        uses: actions/cache@v3
-        with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/index/
-            ~/.cargo/registry/cache/
-            ~/.cargo/git/db/
-            target/
-          key: ${{ runner.os }}-cargo-agent-${{ hashFiles('agent/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-agent-
-
-      - name: Build agent (cross-compile for Windows)
+      - name: Toolchain sanity check
+        shell: pwsh
         run: |
-          # Target is installed by the toolchain step above (single source of truth).
-          cd agent
-          cargo build --release --target x86_64-pc-windows-gnu
+          # Fail early with a clear marker if the pre-installed toolchain is not reachable.
+          cargo --version
+          rustc --version
+
+      - name: Build agent (native x86_64-pc-windows-msvc)
+        shell: pwsh
+        run: |
+          # crt-static and the default target come from .cargo/config.toml; we pass --target
+          # explicitly so the artifact path is deterministic regardless of host defaults.
+          Set-Location agent
+          cargo build --release --target x86_64-pc-windows-msvc
+          Write-Host "[OK] Built agent for x86_64-pc-windows-msvc"
 
       - name: Upload agent binary
         uses: actions/upload-artifact@v3
         with:
           name: guruconnect-agent-windows
-          path: agent/target/x86_64-pc-windows-gnu/release/guruconnect.exe
+          path: agent/target/x86_64-pc-windows-msvc/release/guruconnect.exe
           retention-days: 30
 
   security-audit: