writ System scope: TargetSystem returns / on Windows, and adopt classifies against %SystemRoot% #761

Feature: #762 — The writ lifecycle surface: reconcile, scopes, and the vocabulary settlement

On Windows, three parts of writ disagree about where the System scope points. On Unix two of them agree by
accident and the third is unreachable.

Ruled 2026-08-31

System targets / on Unix and %SystemDrive%\ on Windows. Period.

What the code does

TargetSystem():

func TargetSystem() string {
	if configured := viper.GetString("writ.targets.system"); configured != "" {
		return expandPath(configured)
	}
	return "/"
}

There is no runtime.GOOS branch. On Windows a bare / is drive-relative — it anchors to whichever drive
the process happens to be standing on, which is the exact defect OpenTree's absolute-path requirement
exists to prevent (see SetStoreRoot, which absolutizes for the same reason).

inferScope's doc comment:

Unix: paths under $HOME are Home, paths under / are System. Windows: paths under %USERPROFILE% are
Home, paths under %SystemRoot% are System.

%SystemRoot% is C:\Windows. %SystemDrive%\ is C:\. So on Windows, writ adopt classifies a file as
System only if it sits under C:\Windows, while writ deploy would write System files to a drive-relative
/. A file adopted into System/ cannot be deployed back to where it came from, and a file under
C:\ProgramData is classified Home or not at all.

Why it has not been noticed

Unix has no %SystemDrive%, and / is correct there, so both sites agree on the platform the suite is
developed on. The divergence exists only on Windows, and writ deploy to System on Windows is not
something the scenario tests exercise.

Fix

TargetSystem() branches on runtime.GOOS: %SystemDrive%\ on Windows, / elsewhere, with the
writ.targets.system override winning on both as it does today. inferScope classifies against the same
function rather than against its own idea of the root -- the duplication is what let them drift.

Verification

• On Windows, TargetSystem() returns %SystemDrive%\ and never a drive-relative path.
• writ adopt classifies C:\ProgramData\x and C:\Windows\y alike as System, because both are under
  %SystemDrive%\.
• A file adopted into System/ deploys back to the path it was adopted from -- the round trip that is
  broken today.
• inferScope and TargetSystem cannot disagree, because only one of them decides.
• The Unix behaviour is unchanged.

Neighbours

• The writ.targets.* config key is in the shipped defaults file and absent from the schema, the same shape
  as #746. It is renamed to writ.scopes.* by the
  vocabulary ruling, which is tracked separately.
• TargetSystem and TargetHome are renamed ScopeSystem / ScopeHome by that same ruling. This issue is
  about the value they return, not their names, and is independently fixable.