feat: complete WorkBuddy parity and Windows release workflow

scripts/sandbox-maintain.mjs

@@ -0,0 +1,15 @@
+import { build } from 'esbuild'
+import { promises as fs } from 'node:fs'
+import { randomUUID } from 'node:crypto'
+import { join } from 'node:path'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+
+const project = fileURLToPath(new URL('../', import.meta.url))
+const temporary = join(project, '.tmp')
+await fs.mkdir(temporary, { recursive: true })
+const output = join(temporary, `sandbox-maintenance-cli-${randomUUID()}.mjs`)
+try {
+  // One node entry point avoids npm's double cmd-shim escaping of path arguments.
+  await build({ absWorkingDir: project, entryPoints: ['scripts/sandbox-maintain.ts'], bundle: true, platform: 'node', format: 'esm', outfile: output, logLevel: 'warning' })
+  await import(pathToFileURL(output).href)
+} finally { await fs.unlink(output).catch(() => undefined) }