Implement `design_docs/003-the-probe-host-and-the-move-to-wsl.md` nf-b1k5 ← Beads

Twinned from https://github.com/cfsh/ninefold/issues/548 by tools/beads/import_github.py's reconcile pass.

Implements [design 003](https://github.com/cfsh/ninefold/blob/main/design_docs/003-the-probe-host-and-the-move-to-wsl.md) (PR #547).

Recommendation, in two lines. Don't split the probe host across the OS boundary — remove the boundary from the probe host. Make the probe suite platform-agnostic, run it on Linux under Xvfb as the per-merge gate, keep a periodic Windows sweep as the artifact check, and give the probe baseline a host field so a sweep can never be silently diffed against another host's set.

Measured 2026-08-05 on Godot 4.7.1 mono for Linux with no GPU: the full 34-probe suite runs at 29/34 as-is and 33/34 after a one-line fix to a real game bug the Linux run found (TonapseHome.ResFiles enumerates demo data unsorted, so pattern-roster order is filesystem order — this affects the shipped Linux export too). Answers two of the three questions design 002 §8.3 left open.

Shape of the work — roughly 12–14 PRs in three phases. The full breakdown is §8 of the doc; do not re-derive it.

• Phase 0 (7 PRs) — lands first and stands alone on Windows. Exec bits (13+ documented ./x entry points are committed non-executable), one Godot locator replacing six copies and three env-var names, the ResFiles sort bug, a bundled mono font, focus-ring robustness, OS-guards for four Windows-only tests, and --audio-driver Dummy + --fixed-fps. Every one of these improves the current Windows setup; if the migration were cancelled tomorrow they should still ship.
• Phase 1 (5 PRs) — the platform-agnostic probe host. Display strategy in probe.py, explicit renderer pinning, the host field in the baseline, --doctor learning Linux, and then running the suite on the real WSL box — which is the decision gate for Phase 2.
• Phase 2 (6 PRs) — the atomic cutover. Provisioning, clones to ext4, the reviewer dispatcher, the periodic Windows sweep, docs, and amendment A3 to design 001.

⚠️ Ordering constraint that is not negotiable: the host field (piece 10) must land before any Linux-hosted merge. Without it, a host-induced probe failure is reported as "this merge regressed main" against an innocent sha and then absorbed permanently into standing, where it can never fire again — silent coverage loss, the #389/#412 shape.

⚠️ No mixed period. Two independent adversarial passes found that a window where some merges gate on Windows and some on Linux makes the shared baseline oscillate. Cutover is one action, baseline re-recorded in the same action, from main.

Related: #417 (CI location — blocked on exactly the unknown this doc resolves), #458, #543, #471/#514 (probe flakiness, which --fixed-fps addresses structurally), #488 (the frame-pacing bug a software rasterizer cannot see — the reason for the Windows sweep).