enhance: test on Windows and fix what it found (#1348)

Adds a weekly and on-demand workflow that runs the cross-compiled tests on Windows Server 2025 Core in a [dockur/windows](https://github.com/dockur/windows) QEMU VM, and fixes the Windows bugs it found in host and UNC paths, env handling, shell quoting, post-task scripts, health checks, checkout, action symlinks, step summaries, Git client certificates and docker mode from a Windows host.

Host-mode steps now emit UTF-8, `bash` falls back to Git's bash instead of the WSL launcher, the runner can run as a native Windows service, steps can keep background helpers with `RUNNER_TRACKING_ID`, and Windows arm64 binaries are released.

Fixes: https://gitea.com/gitea/runner/issues/1339
Fixes: https://gitea.com/gitea/runner/issues/637
Fixes: https://gitea.com/gitea/runner/issues/1172
Fixes: https://gitea.com/gitea/runner/issues/347
Reviewed-on: https://gitea.com/gitea/runner/pulls/1348
Reviewed-by: bircni <[email protected]>

act/runner/logger.go

@@ -479,11 +479,15 @@ func (f textFormatter) isColored() bool {
 // such as a container name or a job summary. Masks added at runtime count, so a summary written
 // after ::add-mask:: is covered too.
 func (rc *RunContext) maskSecrets(value string) string {
+	return NewSecretReplacer(rc.secretMaskers()).Replace(value)
+}
+
+func (rc *RunContext) secretMaskers() []string {
 	oldnew := rc.Config.maskers()
 	for _, mask := range rc.Masks {
 		oldnew = AppendSecretMasker(oldnew, mask)
 	}
-	return NewSecretReplacer(oldnew).Replace(value)
+	return oldnew
 }
 
 // maskers is every value this job's configuration says to hide, whatever the sink.