Add bounded Windows socket handoff across IOCP shards

[renerocksai]

Windows --shards 3 now runs three independent IOCP owners behind one exclusive listener. Previously, Windows rejected multiple shards. Shard zero accepts connections and handles its round-robin share; the cluster creates no extra acceptor thread.

Each accepted socket retains one shared admission charge through transfer, queue residence, and adoption. Destinations associate sockets with their own IOCP before receiving request bytes. Fixed queues transfer only socket metadata. Original deadlines and separate cancellation ownership remain intact. Receivers acquire the publication-completion flag before their final queue-empty check, so shutdown cannot abandon a final transfer.

The PR preserves the callback/writer API, Linux scheduling, and macOS topology. It adds deterministic ownership fixtures, nine native Windows wire cases, an illustrated architecture section, and a pinned evidence packet. The new SVG is included in both the offline whitepaper and the Markdown reader.

Windows defaults to one shard. Explicit inline configurations permit 1–64 owners within the startup memory budget; native fixtures exercise 1–4. Each owner still reserves the full connection capacity. Admission includes queued and transferring sockets, with one additional accept staging socket and one listener outside that count. Provider resources remain outside framework heap accounting. Application callbacks on separate shards can run concurrently and must obey the existing ownership contract.

Validation on final pushed head 419de5445901a87ea6973020df5b13a420917483, using exact Zig 0.16.0:

Gate	macOS	Linux	Native Windows x64
Debug and ReleaseSafe	16/16 steps; 80 tests, 4 platform skips per mode	16/16 steps; 82 tests, 2 Windows skips per mode	16/16 steps; 95 tests, 4 POSIX skips per mode
Wire cases	84	84	89; 4 POSIX suspension skips
Comparator fixtures	9	9	9
Embedding responses	3 per mode	3 per mode	3 per mode
Exact-body smoke	30,000	30,000	30,000

Final Windows run 34044844060 executed the exact PR head. Final live connections, live operations, and late allocations were zero. The final documentation build and nine browser cases passed, including diagrams, rendered Markdown, mobile layout, offline viewing, and printing.

The candidate report preserves the initial qualified implementation, raw commands, exact host metadata, source hashes, watchdogs, and artifact digest. Later gates remain associated with their actual workflow commits; no cross-compilation is promoted to runtime evidence.

Windows throughput, ARM64, service integration, and physical deployment remain unqualified. macOS distribution remains queued. The wiki should ingest the merged implementation and report after review and merge; its M3-006 remains postponed.