Implement remaining Wine-visible Nt and Zw services

[stakach]

Migrated roadmap scope. Historical context: completion ledger.

Dependencies: #7, #9, #10, #12.

Acceptance

• Use the checked reconciliation manifest to select remaining native services and implement each Nt/Zw pair together.
• Use shared nt-syscall-abi numbering and real object/VM/I/O/security/IPC primitives; never Wine host syscall ordinals.
• Add subsystem behavior and failure tests; update verifier catalog only for real implementation.

Track progress and verification here and in PRs. Host specs, native builds and end-to-end proof are distinct; retire superseded machinery at its actual cutover.