Wide-spread plumbing + Windows-only plm crate skeleton:

- wxc-exec --audit flag, console-control handler, named-mutex singleton
- AppContainer release-build gate rejecting permissiveLearningMode
- �udit field in wire model and config parser
- plm crate: clap dispatch for start/stop/log, WPR start/stop, embedded
  WPR profile materializer, singleton coordination, wpr.exe path
  resolution
- CI/build infra (Azure Pipelines + GitHub Actions) to build plm.exe
  and stage it next to wxc-exec.exe via build.bat

Event parsing, capability extraction, filesystem/UI merging, and the
adjusted-config writer arrive in subsequent PRs.

Builds + tests pass: cargo fmt --check, cargo clippy -p plm,
cargo test -p plm (25 tests).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Replace the workspace's bespoke default-members = members - plm list with the implicit default (all members), and remove the crate-level #![cfg(target_os = "windows")] on plm's main.rs. The Windows-only body is gated per-item; a tiny non-Windows fn main() prints and exits 1 so the binary still links on Linux/macOS.

Drops the special-cased -p plm/--lib steps in the GitHub Actions and Azure DevOps templates that existed solely because plm was excluded from default-members; the regular workspace build now covers it, and the Linux gate keeps a -p plm build/test step so the cross-platform contract is still CI-enforced.

Also adds core/mxc-sdk to the implicit default (Copilot review #12).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Addresses MGudgin / Copilot review feedback on PR #584:

  #2  --audit lifecycle chatter (spawn banner, non-zero-exit / spawn-fail
      lines, capability-injection warning) now writes only to the log
      buffer by default; add --audit-verbose to also surface them on
      stderr for pipeline-debugging.
  #3  Replace the encode_utf16+PCWSTR mutex-name literal with the
      windows::core::w!() macro in both wxc-exec (Global\\Mxc_Plm_Audit)
      and plm.exe.
  #4  Scope chrono to default-features = false, features = std+clock so
      it stops dragging js-sys / wasm-bindgen / iana-time-zone into the
      dep tree.
  #5  Clarify the "PLM runs as administrator" comment — the elevation
      lives in "launched --audit from an elevated context" (needed for
      WPR kernel session), not a PLM-internal auto-elevate.
  #6  Drop stale build.rs comment referencing the pre-embedded WPR
      profile staging.
  #8  run_plm_command doc no longer claims plm failures never abort;
      documents that --audit's "plm start" caller does abort while
      "plm stop" falls through to wpr -cancel cleanup.
  #9  --audit's "is capability already present?" check is now case-
      sensitive (matching the downstream AppContainer runner) so an
      operator's mis-cased spelling doesn't silently disable the
      injection.
  #10 Move mark_plm_trace_active() out of plm's main.rs into a callback
      that log::run fires only AFTER wpr -start engages. Prevents a
      Ctrl+C during stdin-prompt or spawn-fail from issuing wpr -cancel
      against an unrelated host WPR session.
  #11 WprExeStopper::stop no longer builds wpr_command() twice — reuse
      the single builder instead of constructing a throwaway just to
      read get_program().
  #13 Remove the extra "// " in dacl_ctrl_handler's comment header.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

… deps, extract wxc audit module

- Drop future-PR/past-state phrasing from plm module doc-comments
- Prepend MIT copyright headers to coordination.rs, profile_gen.rs, wpr_path.rs
- Simplify plm log trace filename (drop PID and parse-preview note)
- Move serde_json/chrono/roxmltree to workspace [workspace.dependencies]
- Use wxc_common::string_util::from_wide in plm::wpr_path
- Add plm::coordination::singleton with shared try_acquire/release helpers;
  both plm::main and wxc::audit now delegate to it
- Extract PLM audit lifecycle (~230 lines) from wxc/src/main.rs into
  wxc/src/audit.rs

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Removes the runtime feature that reordered every serde_json Map — which was the sole cause of the dev schema on this branch differing from main. The feature was consumed only by a dead type alias in plm/src/config.rs. Regenerated dev schema now matches main byte-for-byte.

The atomic itself has to stay a process-wide static because the
Windows console-control handler (plm_ctrl_handler) is an OS-owned
extern "system" callback with no captured self/environment — it
can only reach state via process globals. But all non-signal-context
mutation now goes through &AcquiredSingleton methods:

- mark_trace_active(&self)  — was free fn mark_plm_trace_active
- clear_trace_active(&self) — was free fn clear_plm_trace_active
- cancel_active_trace(&self) — was free fn cancel_active_plm_trace

The compile-time invariant is that trace-active can only be flipped
while we hold the host-wide Global\\Mxc_Plm_Audit singleton mutex —
you can't call these methods without first producing an
AcquiredSingleton. The single remaining free-fn escape hatch,
cancel_active_plm_trace_from_signal(), is documented as callable
only from the ctrl handler (where no &self exists).

Also: AcquiredSingleton::drop now cancels any leftover trace before
releasing the mutex, so an error mid-flow can't leak the kernel
session past exit.

The Cmd::Log flow uses the singleton bypass path (when wxc-exec
--audit already holds the mutex outer-process) — that branch falls
back to touching PLM_TRACE_ACTIVE directly because no local
AcquiredSingleton exists in the bypass case.

Addresses PR584 review comment r3503762141 more thoroughly than the
prior doc-comment-only fix.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>