Fix Fix now preflight failures and prepare stateless support for 6.4.1

[JG2547]

In 6.4.0, a failed or empty Windows tool probe after Fix now could become seven false missing-tool errors in both Setup and Portable. Preflight now requires a successful process result and a complete inventory. A failed check produces one explanation with retry and Support Report actions; genuinely missing tools share one blocker. The reported PC's exact environmental trigger remains unproven without its runtime log.

Repair and elevation use allowlisted absolute Windows system paths. Repair PowerShell reads UTF-8 source through stdin, keeping dynamic scripts and helper passwords out of PowerShell arguments and temporary script files. Failed or timed-out results cannot establish administrator status, successful relaunch, or a running Secondary Logon service. Process handling also preserves Unicode and completes once.

The three support forms use one explicit anonymous HTTPS submission, show Sent only after a valid acknowledgement, and retain drafts for manual retry. Support server code and its Postgres CI job move out of this repository. Release packaging now requires a verified stateless support endpoint. This prepares version 6.4.1; it does not publish a release.

Validation:

• Recorded Linux npm test completed successfully, including 98 tool-resolution checks, 108 preflight checks, 23 process checks, 84 desktop submission checks, and elevation, endpoint-readiness, and checksum regression coverage.
• Native Windows PowerShell/elevation and packaged Setup/Portable validation remain pending. The package-dependent check was skipped because no Windows build was present; a rendered desktop capture was unavailable.

Safety impact

• Changes local account tool execution paths
• Changes privilege and elevation verification
• Changes credential transport to PowerShell
• Changes release endpoint validation and patch version
• None of the above

This touches safety-sensitive code. A real code-owner review is required by CONTRIBUTING.md; the administrative review exception does not apply.

Release dependency

The support source is merged in support PR #1. Support issue #2 tracks the private bot handoff and live release proof. No Windows tag or release will be published until that endpoint and all three form journeys pass for both packages.

Verification

• Recorded local npm test passes
• Documentation updated
• Code-owner approval on the final head
• Final-head native Windows and packaged acceptance after resolver hardening
• Live support receipts for Setup and Portable

Review exception

Not applicable: safety-impact changes require code-owner approval.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[JG2547]

CONTROL REVIEW OF RECORD — TECHNICAL ACCEPTANCE PASS / MERGE PENDING REQUIRED APPROVAL

• Head: 5eac56da0d6c792ff3d71b6aac623343ecb20715
• Base: 0981a721b91972a18b6240056f0e0a9e797dd33a
• Independent exact-head review: PASS; no actionable findings.
• Both prior forged-environment P1 findings are fixed, including scoped ComSpec handling and a non-vacuous forged-root smoke path.
• Exact-head hosted checks: PASS, including Build & Test, Code Quality, Support Service, brand-assets, Dependency audit, Licence and binary inventory, and CodeQL.
• Packaged evidence includes packaged-runtime-smoke 17/17 PASS, forged-root.os-tool-authority PASS, and forged-root.leaves-checking PASS.
• Merge state remains BLOCKED only by repository-required review. The existing reviewer request to patricktobias86 is preserved and was not duplicated.

Control will use an expected-head guarded merge only after that independent repository approval exists. No tag, release, or deployment is authorized by this review record. Live Setup/Portable support receipts remain a separate runtime-verification item and are not claimed here.