feat: add optional Parallels testing for Windows app

[RomneyDa]

Depends on openclaw/openclaw#107881. Land that PR first because it provides the shared Parallels controller used here.

Design choice: I specifically chose to make the Parallels workflow a sidecar to the existing proof-validation skill because most Windows developers will not be working from macOS. The original implementation was an independent skill, and we can split it back out if that proves useful, but it would create a first-class skill that developers working on Windows would never use.

Summary

Adds an optional macOS/Parallels backend for validating the Windows app. The instructions are a sidecar to openclaw-proof-validation, not a standalone skill, so normal Windows development keeps the native workflow.

The shared OpenClaw controller prepares the general Windows environment. This PR adds only what the native Windows app needs:

• .NET 10 SDK;
• Windows SDK 10.0.26100;
• WebView2 Runtime;
• a clean openclaw-windows-node checkout;
• an app-specific reusable snapshot; and
• a bounded runner for the required build, Shared tests, and Tray tests.

Quick start

With compatible openclaw and openclaw-windows-node checkouts beside each other:

./scripts/parallels-windows-vm.sh inventory
./scripts/parallels-windows-vm.sh prepare
./scripts/parallels-windows-vm.sh run-tests

Useful snapshot commands:

./scripts/parallels-windows-vm.sh restore --snapshot app
./scripts/parallels-windows-vm.sh run-tests --ref <branch-or-sha>

The app alias selects the newest pre-openclaw-windows-app-e2e-* snapshot. Existing snapshots are restored and verified before reuse.

How it fits with OpenClaw

The OpenClaw repo owns the general VM lifecycle, WSL/Git/Node setup, verified installer staging, clean-state checks, power-off snapshot creation, restore aliases, and common Parallels troubleshooting.

This repo keeps the native app packages and validation close to the app code. macOS users are routed to .agents/skills/openclaw-proof-validation/PARALLELS.md by one conditional line in the existing proof skill; there is no separate Parallels skill or UI chip. The wrapper fails clearly when the required sibling OpenClaw controller is missing.

Change Type

• Feature
• Docs or instructions
• Tests or validation

Validation

• Shell syntax, diff checks, and skill validation: passed
• Live app provisioning and app snapshot restore: passed
• Existing general and app snapshots restored and verified: passed
• Full Windows build: passed
• Shared tests: 2,754 passed, 31 environment-gated skips, 0 failed
• Tray tests: 1,705 passed, 0 failed

Real Behavior Proof

• Environment: Parallels Desktop 26.4, Windows 11 ARM64, WSL 2.7.10, Node.js 24.18, .NET 10.0.302, Windows SDK 10.0.26100, WebView2 150.0.4078.65
• Current head: e39ad174; runtime proof was collected at parent f8c29897 before the skill was moved to a Markdown sidecar
• Commands: ./scripts/parallels-windows-vm.sh prepare and ./scripts/parallels-windows-vm.sh run-tests
• Result: the wrapper restored both snapshot layers, verified all app prerequisites, built every required project, and passed both required test suites
• Landing requirement: feat: add reusable Parallels Windows test setup openclaw#107881 must land first; this PR intentionally does not duplicate the shared controller

Security Impact

• No secrets, tokens, or app permissions change.
• Native installers reuse the shared controller's exact WinGet manifest hashes, Authenticode publisher checks, ACL-restricted staging, reboot handling, and host-side timeouts.

Compatibility and Migration

• Backward compatible: Yes, after the dependent OpenClaw PR lands
• New user configuration: No
• Migration required: No

Review Conversations

• I replied to or resolved every bot review conversation addressed by this PR.
• I left unresolved only conversations that still need maintainer judgment.