feat: add safe miner control foundation

scripts/test-windows-agent-source.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+service="agents/windows/MinerOpsAgentService.ps1"
+control="agents/windows/MinerOpsControl.ps1"
+rg -q 'X-MinerOps-Agent-ID' "${service}"
+! rg -q 'commands/pending\?agent_id=' "${service}"
+! rg -q 'DefaultValue "super"' "${service}"
+rg -q 'get\.miner\.setting' "${control}"
+rg -q '\$attempt -le 3' "${control}"
+rg -q 'VerificationStatus "unconfirmed"' "${control}"
+for secret_field in 'api3_password =' 'api3_account =' 'raw_vendor' 'salt_response'; do
+    ! rg -q "${secret_field}" "${control}"
+done
+
+if command -v pwsh >/dev/null 2>&1; then
+    pwsh -NoProfile -File agents/windows/tests/Test-MinerOpsControl.ps1
+else
+    echo "pwsh is not installed; deterministic PowerShell harness retained but not executed."
+fi
+echo "Windows Agent source contract checks passed."