feat: support Python 3.12–3.14 and Windows x64

[ReallocAll]

Summary

Support Python 3.12, 3.13 and 3.14 on Linux x86-64 and Windows x64, including a verified single-Wheel EndKeep installation on the supported six combinations.

• Pin the four previously published, unofficial Amulet-LevelDB 3.0.7a0 compatibility Wheels (Python 3.12/3.13 × Linux/Windows) to GitHub Release URLs with SHA-256 hashes; Python 3.14 uses the official PyPI package. Keep EndKeep itself a single py3-none-any.whl.
• Fix Windows low-level binary byte preservation for LevelDB and SIDECAR, junction/path traversal checks, worker process safety, Windows file-flush compatibility and platform-specific regressions.
• Restrict hatch-vcs to EndKeep vX.Y.Z tags because the separate Amulet compatibility Release tag otherwise breaks builds.
• Validate fresh pip/Endstone dependency installation, backported C++ builds, and EndKeep tests across all six interpreter/platform combinations.
• Document platform support, installation, recovery, Windows NTFS crash-durability boundaries, and reproducible real BDS evidence.

Validation

• Cross-platform matrix: Python 3.12, 3.13, 3.14 × Linux and Windows x64 all passed with fresh dependency resolution using the pinned GitHub Release URLs:
  https://github.com/ReallocAll/endkeep/actions/runs/37976573011
• Real BDS: Linux and Windows each passed BDS 1.26.52.3 / Endstone 0.11.13 / Python 3.14 tests: plugin loading, two online backup captures, BASE+DELTA maintenance, deep verify, export, native server stop, cleanup of the intentionally reload-persistent worker, and offline verify/restore:
  https://github.com/ReallocAll/bds-test-lab/actions/runs/37977425842
• Final documentation commit: 92d32c50cc076ea5d4f3b82caabf2a081e5648c3, Build and compatibility checks in progress.
• Existing project tests: Windows binary copy, junctions, process liveness, file fsync errors, and repository recovery scenarios.

Known boundaries

• The Amulet compatibility Wheels are third-party builds under the Amulet Team License, not MIT, and are not official upstream distributions. Each published Wheel includes the license and Required Notice.
• NTFS sudden-power-loss durability has not been proven equivalent to POSIX directory fsync. The BDS tests cover clean shutdown and restartable backup history; do not interpret them as physical power-loss testing.
• Some uv lock versions reject extreme numeric version metadata from upstream amulet-compiler-version. The supported developer setup uses uv pip install; the existing uv.lock is stale pending an upstream fix.

The original experimental branch experiment/amulet-leveldb-cp311-cp314 remains unchanged. This PR may be squash-merged after the final CI checks succeed. EndKeep release will follow the merge as a separate versioned change.

[ReallocAll]

Review and fix follow-up for the Python 3.12–3.14 / Windows compatibility PR.

Fixed directly on feat/python312-windows-compat (latest head dee5501d):

• Windows SIDECAR extraction was still writing arbitrary bytes through a CRT descriptor without O_BINARY. This could corrupt recovered level.dat or other sidecar files even when LevelDB staging and cloning were byte-exact. The restore writer now opens in binary mode and has an arbitrary-byte round-trip regression test.
• Staging and SIDECAR extraction could call mkdir before confirming their resolved parent stayed within the designated destination. Validate paths before filesystem mutations, reject nonportable Windows drive/ADS/backslash paths, and require all staged files to belong to the manifest's world prefix.
• Added negative-path regression tests and fixed import/format lint issues.

Verification: the latest standard Build (lint, formatting, tests, package and offline smoke) passed: https://github.com/ReallocAll/endkeep/actions/runs/37973225784 . The latest six-combination compatibility workflow has not completed yet: https://github.com/ReallocAll/endkeep/actions/runs/37973226010 .

Release/merge gates remain: stable and license-compliant distribution/installation of CPython 3.12/3.13 Amulet wheels, verification of the Amulet Team License notices, real Endstone/BDS backup/restore tests on Linux and Windows, and explicit review of NTFS crash/directory-metadata persistence semantics. A green CI matrix is necessary but not sufficient for those guarantees. No merge or release was performed.