fix(TST-25,TST-26): restore Windows/x86 CI tier via SSH-driven windev job

The `windows`/`live-mxaccess` CI jobs were removed in abb0930 because Gitea
act_runner host-mode on Windows is broken and a runs-on gate with no runner
wedges the queue. This left the entire x86/net48 Worker + Worker.Tests tier
(and the live-MXAccess smoke) unguarded by CI.

Restore it without a native Windows runner: Linux jobs on ubuntu-latest (which
always schedule) SSH to windev (10.100.0.48), fetch+checkout the SHA under test
in an isolated clone C:\build\mxaccessgw-ci, run the x86 build/tests there, and
propagate the remote exit code back — so a Worker regression turns the job red
and an unreachable host fails loud (never stuck).

- scripts/ci/run-windev-ci.sh: Linux driver (key/known-hosts, UTF-16LE base64
  EncodedCommand bootstrap, ssh, exit-code passthrough).
- scripts/ci/windev-worker-ci.ps1: windev stage — worktree lock, re-fetch/
  checkout under lock, build|test|live modes; PS 5.1-safe, checks $LASTEXITCODE.
- scripts/ci/windev.known_hosts: pinned host keys for StrictHostKeyChecking.
- scripts/ci/README.md: operator bring-up + acceptance checklist.
- ci.yml: windows-x86 (per-push `test`) + nightly-windev (scheduled `live` +
  on-failure Gitea issue); drop the removal note; fix header/cron comments.

TST-26 (same commit, by rule): correct docs/scripts that still describe the
removed jobs — GatewayTesting.md, Contracts.md, check-codegen.ps1 — and
reattribute the Generated/-commit guard (primary = check-codegen diff in the
portable job; secondary = windows-x86 net48 compile).

Mechanism hand-verified on windev: build->0, bogus-SHA->nonzero (lock released),
test->356 passed/0 failed in ~50s, ssh exit-code propagation confirmed. Merge
requires operator bring-up first (dedicated ci@ key + Gitea secrets) or the
per-push job is red every push — see scripts/ci/README.md.

docs/GatewayTesting.md

@@ -423,18 +423,38 @@ runtime because the x86 Worker cannot build on Linux:
   `MxaccessGateway.java` with spurious protobuf-runtime-version churn on every build, so
   when no `.proto` changed the job reverts that one file (`git checkout`) before asserting
   the generated tree is clean. The dev Mac has no JRE, so Java verification is CI-only.
-- **`windows`** (self-hosted windev runner) — the only host that builds the **x86 /
-  net48 Worker and Worker.Tests**; these are Windows-only and out of scope for the Linux
-  jobs. This job also proves the net48 build against the committed `Generated/` (the
-  definitive guard for the "regenerate and commit `Generated/`" rule).
-- **`live-mxaccess`** (self-hosted, MXAccess-installed) — scheduled only
-  (`MXGATEWAY_RUN_LIVE_MXACCESS_TESTS=1`); never gates a push.
+- **`windows-x86`** (Linux runner, per push/PR) — builds the **x86 / net48 Worker and
+  Worker.Tests**, which are Windows-only and out of scope for the Linux jobs. It runs on a
+  Linux runner that always schedules and SSHes to windev (`10.100.0.48`), where
+  `scripts/ci/run-windev-ci.sh` fast-forwards the isolated CI clone `C:\build\mxaccessgw-ci`
+  to the SHA under test and runs `scripts/ci/windev-worker-ci.ps1 -Mode test` there; the
+  remote exit code propagates back, so a Worker regression turns the job red. A native
+  Windows runner is not used because act_runner host-mode on Windows is broken and a
+  `runs-on` gate with no runner wedges the queue forever. **A red `windows-x86` can mean
+  the tier is down, not the change**: an unreachable windev fails the job (never skips), so
+  if it goes red without a related code change, check the tier — `ssh windev`, read
+  `C:\build\mxaccessgw-ci\ci.log` — before assuming a real test failure.
+- **`nightly-windev`** (Linux runner, scheduled `0 6 * * *`) — re-runs the full x86 build +
+  Worker.Tests on windev, then the live-MXAccess smoke (`MXGATEWAY_RUN_LIVE_MXACCESS_TESTS=1`)
+  and a full `slnx` build (which surfaces Windows-only analyzer diagnostics such as
+  `xUnit1030`). Gated `if: github.event_name == 'schedule'`, so it never gates a push. On
+  failure it opens a Gitea issue via the Actions token, since nobody watches the Actions page.
 
 The freshness guard `scripts/check-codegen.ps1` fails the build when the committed
 client descriptor set or the C# `Generated/` no longer matches the current `.proto`
 sources — the codegen drift class this repo has hit repeatedly (stale client
-descriptors, net48 `CS0246` on unregenerated protos). See
-[Client Proto Generation](./ClientProtoGeneration.md) and [Contracts](./Contracts.md).
+descriptors, net48 `CS0246` on unregenerated protos). The **primary** guard for the
+"regenerate and commit `Generated/`" rule is that regeneration diff in the `portable` job;
+the `windows-x86` net48 compile is the **secondary** guard (a stale `Generated/` also breaks
+the x86 build with `CS0246`). See [Client Proto Generation](./ClientProtoGeneration.md) and
+[Contracts](./Contracts.md).
+
+If the SSH-driven Windows tier is unavailable for infrastructure reasons (windev down, CI
+key/secret rotation in flight), fall back to the manual windev worktree procedure as a
+degraded mode: on windev, fast-forward an isolated `origin/main` worktree under `C:\build`
+(never the dirty Desktop checkout), then run the x86 Worker build and `Worker.Tests`
+(`-p:Platform=x86`) there by hand. Do this per merge for worker-touching changes until the
+`windows-x86` job is green again.
 
 ## Related Documentation