Add Windows system artifacts and corpus lab

[abrignoni]

Summary

• modernize ActivitiesCache, Notifications, Sticky Notes, and SetupAPI Sections from WLEAPP for DLEAPP
• add a focused Windows profile, timestamp-first reports, migration audit, and parser tests
• add a controlled Windows VM corpus-lab workflow with inventories, action journaling, raw-copy manifests, and clearly labeled SQLite snapshots

Validation

• python3 -m pytest -q admin/test/scripts — 22 passed
• focused profile corpus run — 5 ActivitiesCache, 3 Notifications, 2 Sticky Notes, and 1 SetupAPI row
• verified HTML, TSV, timeline, and LAVA outputs with no parser errors
• verified persisted corpus against SHA256SUMS.txt

Forensic notes

• live-locked SQLite databases are retained as raw-copy failures; parser-test snapshots are explicitly labeled examiner-derived and not byte-for-byte evidence
• SetupAPI times are labeled device-local and are not described as first-connection times

Authors: @AlexisBrignoni, Codex