feat(helper): fully manage elevated windows; add opt-in uiAccess build

[blendonl]

Make mshell own admin-owned windows as completely as ordinary ones, and
spell out the anti-cheat-safe posture that keeps this usable on a gaming
machine. Nothing here injects into another process or touches the boot
chain, so Secure Boot / TPM anti-cheat is unaffected.

Helper protocol (proto v5):

• PROTO_SHOW: ShowWindow() on a higher-integrity window, so a minimized
  admin window can actually be restored. ShowWindow can't report a UIPI
  refusal, so window_unminimize() and window_focus() now confirm the
  iconic bit cleared and fall back to the elevated helper when it didn't
  — previously a minimized admin window was unrecoverable with no taskbar.
• PROTO_SETSTYLE: set GWL_STYLE/GWL_EXSTYLE cross-integrity, so an admin
  window loses its title bar and min/max buttons like every other tiled
  window. window_strip/restore_decorations() use it when the direct call
  is refused.

uiAccess build variant (opt-in, make UIACCESS=1):

• Separate uiAccess="true" manifest selected via a windres macro; the
  default asInvoker build is unchanged so an unsigned shell still boots.
• Report the real TokenUIAccess state at startup (the manifest alone does
  not grant it — the binary must be signed and under Program Files).
• INSTALL.md documents the signing / location requirements and the verify
  step.

Also:

• Set SDL_VIDEO_MINIMIZE_ON_FOCUS_LOSS=0 process-wide so SDL games stop
  self-minimizing on focus loss instead of relying on the restore backstop.
• probe_uipi: new manage subcommand that replays strip/restore/move
  against an elevated window to confirm on-machine what UIPI refuses.
• README: document the no-injection / boot-chain non-goal explicitly.

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_017weNsujuHCgUzdttrry2Qe