phase1c: add UiJobObject + split UI policy resolution from encoding

[MGudgin]

📖 Description

Splits the phase1a ui_policy module into two concerns and introduces the Windows Job Object wrapper that consumes the second one.

The policy layer (crate::ui_policy) stays platform-agnostic. It exposes:

• EffectiveUiRestrictions, a record of ten booleans naming which UI capabilities the child must be denied.
• resolve_ui_restrictions(&UiPolicy, &BaseProcessUiConfig) -> EffectiveUiRestrictions, replacing ui_restrictions_bitmask. No windows-crate references; ready for future macOS/Linux consumers.

The UILIMIT_* bare-u64 constants are gone.

The Windows encoding layer (crate::job_object, new) is Windows-only. It exposes:

• UiJobObject, an RAII wrapper around a Windows Job Object that applies UI restrictions to a child and its descendants. set_ui_limits takes an &EffectiveUiRestrictions directly so callers never deal in raw bits.
• to_job_object_uilimit_mask(&EffectiveUiRestrictions) -> u32, the encoder. Sources nine of the ten flag bits from the windows crate (Win32::System::JobObjects::JOB_OBJECT_UILIMIT_* for eight, Win32::System::SystemServices::JOB_OBJECT_UILIMIT_IME for IME). The tenth, JOB_OBJECT_UILIMIT_INJECTION, is hand-typed because the windows crate metadata does not include it; if a future release adds it, the local constant can be removed.

Side effects:

• wxc_common::ui_policy returns to the platform-agnostic section of lib.rs. The Windows-specific encoding moved out, so the module no longer has any OS-specific code.
• base_container_runner.rs is updated to use the new APIs (encoder's u32 is cast to u64 for the BaseContainer FlatBuffer ui_restrictions field).
• Enables the Win32_System_JobObjects feature on the workspace windows crate dependency.
• Drops UiJobObject::handle(); no caller used it and exposing the raw HANDLE was a footgun.

🔗 References

Stacked on top of #290 (phase1b → main).

🔍 Validation

• cargo test -p wxc_common --lib — 336/336 pass
• cargo build -p wxc_common clean
• End-to-end coverage lives in Win25H2Safe-Tests.ps1 in phase5 (held)