test(bootstrap): pin the exit-2 self-marker heal contract + on-demand windows-latest Rust lane

The heal decision is extracted into should_heal_self_marker_refusal()
so the contract is testable: heal ONLY on exit 2 + a marker naming this
process. Five tests pin it — self-owned heals, foreign owner (real live
sibling process) never heals, missing/garbage marker never heals,
non-exit-2 never heals, and the full acquire -> refuse -> drop-claim ->
retry-precondition lifecycle with a real UpdateMarkerGuard.

windows-rust-e2e.yml mirrors the wine2e pattern: fires only on
wine2e-rust/** pushes, runs the crate's cargo test --lib on
windows-latest (the shipping platform). The permanent Linux lane stays
authoritative for the unix-gated pipe-drain fixtures.

.github/workflows/windows-rust-e2e.yml

@@ -0,0 +1,55 @@
+# .github/workflows/windows-rust-e2e.yml
+name: Windows Rust live E2E (bootstrap installer)
+
+# ON-DEMAND ONLY (fleet-update #91277, bootstrap-updater work).
+#
+# Runs the bootstrap installer's `cargo test --lib` on a real windows-latest
+# runner — the platform the installer actually ships on. The permanent
+# rust-tests.yml lane is Linux on purpose (its pipe-drain fixtures are
+# #[cfg(unix)]); this lane exists so Windows-only behavior (marker files,
+# exit-code heals, process probes) can be live-proven on Windows before a PR
+# is presented, per the live-repro gate.
+#
+# Deliberately NOT wired to pull_request/main: it fires only on pushes to
+# wine2e-rust/** working branches, so it costs nothing on normal PRs.
+
+on:
+  push:
+    branches:
+      - "wine2e-rust/**"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: windows-rust-e2e-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  bootstrap-installer-windows:
+    name: cargo test (bootstrap installer, windows-latest)
+    runs-on: windows-latest
+    timeout-minutes: 40
+    defaults:
+      run:
+        working-directory: apps/bootstrap-installer/src-tauri
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      # No webkit2gtk needed on Windows — Tauri links WebView2, which the
+      # runner image already carries.
+
+      # Keyed on Cargo.toml like the Linux lane: the crate has no committed
+      # lockfile (scaffold .gitignore), so there is nothing to hash for
+      # --locked. See rust-tests.yml for the tracking note.
+      - name: Restore cargo cache
+        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            apps/bootstrap-installer/src-tauri/target
+          key: cargo-win-${{ runner.os }}-${{ hashFiles('apps/bootstrap-installer/src-tauri/Cargo.toml') }}
+
+      - name: cargo test
+        run: cargo test --lib