完善 Windows 运维封装与 NTFS 索引解析

- 新增自启动幂等配置、统一错误语义、进程等待和进程树终止能力
- 增强服务生命周期管理，支持等待状态、重启、幂等创建和配置更新
- 新增 NTFS 卷索引、文件 ID 解析、文件遍历、USN 变更监听和 bookmark 持久化
- 修复 NTFS boot sector、fragment、MFT、USN 解析边界和路径重建问题
- 补充权限、进程、服务、NTFS 解析和工作流回归测试
- 增加 Windows 测试脚本和管理员 NTFS smoke 验证脚本
- 升级 Go 兼容版本到 1.18，并更新 stario、win32api 及相关间接依赖

ntfs/bootsect/bootsect.go

@@ -1,6 +1,6 @@
 /*
-	Package bootsect provides functions to parse the boot sector (also sometimes called Volume Boot Record, VBR, or
-	$Boot file) of an NTFS volume.
+Package bootsect provides functions to parse the boot sector (also sometimes called Volume Boot Record, VBR, or
+$Boot file) of an NTFS volume.
 */
 package bootsect
 
@@ -35,12 +35,7 @@ func Parse(data []byte) (BootSector, error) {
 	}
 	r := binutil.NewLittleEndianReader(data)
 	bytesPerSector := int(r.Uint16(0x0B))
-	sectorsPerCluster := int(int8(r.Byte(0x0D)))
-	if sectorsPerCluster < 0 {
-		// Quoth Wikipedia: The number of sectors in a cluster. If the value is negative, the amount of sectors is 2
-		// to the power of the absolute value of this field.
-		sectorsPerCluster = 1 << -sectorsPerCluster
-	}
+	sectorsPerCluster := int(r.Byte(0x0D))
 	bytesPerCluster := bytesPerSector * sectorsPerCluster
 	return BootSector{
 		OemId:                        string(r.Read(0x03, 8)),
@@ -49,7 +44,7 @@ func Parse(data []byte) (BootSector, error) {
 		MediaDescriptor:              r.Byte(0x15),
 		SectorsPerTrack:              int(r.Uint16(0x18)),
 		NumberofHeads:                int(r.Uint16(0x1A)),
-		HiddenSectors:                int(r.Uint16(0x1C)),
+		HiddenSectors:                int(r.Uint32(0x1C)),
 		TotalSectors:                 r.Uint64(0x28),
 		MftClusterNumber:             r.Uint64(0x30),
 		MftMirrorClusterNumber:       r.Uint64(0x38),