fix(ssh,docker): make the SSH and Docker backends build on Windows

[zoza1982]

What

Cairn did not compile on Windows with the full backend stack (--features all-backends): the SSH
and Docker backends each called a Unix-only API unconditionally, so there was no complete
Windows binary. This fixes both and adds a CI gate so it can't regress.

Root cause

Two E0599 compile errors on x86_64-pc-windows-msvc (surfaced when building a Windows test
binary; CI never caught them — see below):

1. SSH — russh::keys::agent::client::AgentClient::connect_env() (reads $SSH_AUTH_SOCK) is
   #[cfg(unix)] in russh. Used for public-key agent auth.
2. Docker — bollard::Docker::connect_with_unix() is #[cfg(unix)] in bollard. Used for an
   explicit socket path (rootless Docker / Podman).

Fix

• SSH (crates/cairn-backend-ssh/src/connect.rs): split the agent pubkey-auth loop into a
  generic helper `agent_publickey_auth(…, AgentClient) where S: AsyncRead + AsyncWrite + Unpin
  • Send(the bound mirrors russh'sSigner for AgentClient`), then connect per platform:
  • Unix: connect_env() — unchanged behavior.
  • Windows: the OpenSSH named-pipe agent (\\.\pipe\openssh-ssh-agent), falling back to Pageant.
• Docker (crates/cairn-backend-docker/src/real.rs): use bollard's cross-platform
  connect_with_socket() (Unix socket on Unix, named pipe on Windows; bollard's pipe feature is
  on by default). Unix behavior is unchanged — bollard's old and new paths both do the same
  eager socket-exists check.

CI: why this was never caught, and the gate added

ci.yml deliberately built only the lean default feature set on Windows/macOS (heavy backends
Linux-only for fast PR feedback), so the transport backends were never compiled on Windows. Added a
windows-portability job: cargo check -p cairn --features ssh,containers on windows-latest
(compile-only; NASM installed because russh's default crypto is aws-lc-rs). It transitively checks
the SSH, Docker, and K8s backends on Windows. The cloud SDKs (s3/gcs/azure) are excluded — they are
cross-platform and already built on Windows by release.yml. The lean-Windows policy comment was
rewritten to sanction this single exception, and a stale note (aws-lc-rs is pulled by russh too, not
only S3) was corrected in both workflow files.

Scope / follow-ups (noted, not in this PR)

• On Windows the Docker named-pipe arm now compiles but is not yet reachable through Cairn's own
  discovery (which only probes $XDG_RUNTIME_DIR, unset on Windows); Docker Desktop's default pipe
  is handled by connect_with_local_defaults. Wiring genuine Windows named-pipe/rootless discovery
  is a separate feature.
• The full all-backends Windows release build (aws-lc/cloud + k8s codegen) is still exercised
  only in release.yml; the PR gate is compile-only and transport-only by design.

Review

Consulted network-engineer (SSH agent fallback), container-backend-engineer (Docker connect),
and devops-engineer (CI strategy). bug-bot + code-review gates run on the diff.

🤖 Generated with Claude Code