[swarit-stepsecurity]

A customer asked for Windows coverage on System Packages after a Node.js fire drill. Qualys finds node by running node -v on PATH and misses everything else: nvm, fnm, Volta, Scoop, zips, and copies bundled inside other apps. Today the Windows tab is greyed out, and none of the three platforms has a way to answer "where is every install of runtime X".

This PR adds two collectors (phase 1 of 3; agent-api and console follow).

Runtime inventory (macOS, Linux, Windows): new phase runtime_scan, new payload field runtime_scan.

• One signature table covers node, python, php, java, go, ruby, deno, bun and dotnet. Each row lists the executable names, the version strategies and the known install roots.
• Versions are read without executing anything:
  • files the install ships (node_version.h, patchlevel.h, Java release, Go VERSION, rbconfig.rb, php_version.h)
  • on Windows, the PE version resource
  • the install path
  • otherwise unknown
• Each record gets an installer attribution (nvm, fnm, volta, pyenv, uv, sdkman, brew, scoop, choco, xampp, go-toolchain, system, installer, manual, …).
• Runtimes shipped inside an app are flagged bundled_by (Xcode, Visual Studio, JetBrains jbr, VS Code Server/extensions, Adobe, …).
• The walk covers the user's home and the machine install locations, plus deeper walks of known version-manager roots. It is breadth-first with a per-root entry budget, so truncation drops the deepest levels instead of whole subtrees, and it reports truncated.
• The walk skips node_modules, VCS dirs, the Go module cache and virtualenvs (the python scan covers venvs). It never follows symlinks or junctions, and resolved binaries are deduped by real path.
• On by default; --disable-runtime-scan / enable_runtime_scan turns it off.

Windows system packages: sent in the existing system_package_scans with new scan_types arp, choco, scoop and winget.

• ARP: the Uninstall keys from HKLM (64- and 32-bit views) and HKCU, filtered like Programs and Features (no SystemComponent, no updates or hotfixes, no nameless entries).
• Chocolatey nuspecs, Scoop manifests (user and global), and winget portable package dirs.
• Registry and file reads only. Neither winget nor Win32_Product is invoked.
• SystemPackage gains scope (machine/user).

Backend note: agent-api has no platform discriminator on system packages yet, so until phase 2 lands, Windows rows would show up under the Linux tab. Merge this after (or together with) the agent-api change.

Testing:

• Fixture-tree tests for every runtime layout on Unix and Windows: versions, attribution, bundled, dedupe, depth cap, budget truncation, cancellation.
• reg query twin tests for ARP filtering, plus Chocolatey, Scoop and winget parsing.
• A real --json run on macOS found 21 installs in about 1.8 s. That run caught three bugs, each now covered by a test: #define parsing ate NODE_MAJOR_VERSION after an include guard, the Python.framework/.../Python dylib matched as an interpreter, and the walk was depth-first so the budget starved later subtrees.
• Not yet run on a real Windows or Linux box; that's next.