🚧 Implement service stub

CHANGELOG.md

@@ -6,6 +6,37 @@ bump per [SemVer](https://semver.org/). Dates are YYYY-MM-DD.
 
 ## [Unreleased]
 
+### Added — Phase 3 Windows service
+- Service host (`service.py`): pywin32 `ServiceFramework` subclass runs the
+  monitoring loop on its own monitor thread; clean SCM stop semantics —
+  `STOP_PENDING` reported immediately, 30 s join-with-timeout, a hung COM
+  poll is **abandoned** (thread never joined, daemon; spec §10.4); service
+  start/stop recorded in the Windows Event Log (`PYS_SERVICE_STARTED/
+  STOPPED`). Verified in-process via the pywin32 debug host against the
+  fake client: start → poll → stop in 0.1 s.
+- CLI verbs `install` / `uninstall` / `start` / `stop` / `status`:
+  - `install` registers the exe **itself** as the service binary (no
+    `pythonservice.exe`, no Python install on the diag host) with
+    auto-start, validates the config **before** touching the SCM, records
+    the config path in the service registry Parameters (startup never
+    depends on the service CWD = System32), configures SCM crash recovery
+    (restart on first+second failure, 5 s delay, 24 h counter reset — the
+    `ChangeServiceConfig2` failure-actions dict shape verified against
+    pywin32's SWIG parser), and registers the Windows Event Log source with
+    its message file (completing the eventlog reporter's deferred step).
+  - Errors map to actionable one-liners: elevation needed, service not
+    installed, service not running, marked-for-delete — plus the raw
+    Windows error code and `net helpmsg` pointer for anything else.
+  - `status` prints the SCM state without needing admin.
+- SCM dispatch: when the SCM starts the exe (fixed `service` argv shape +
+  CWD = System32, exactly what install records in the ImagePath), `main`
+  hands the process to `servicemanager.Initialize` +
+  `PrepareToHostSingle` + `StartServiceCtrlDispatcher`; any other
+  invocation stays a CLI verb.
+- PyInstaller build script: hidden imports added for the service host's
+  lazily-imported SCM modules (`win32service`, `win32serviceutil`,
+  `servicemanager`, `win32evtlogutil`).
+
 ### Added — Phase 2 reporters
 - Rotating JSONL evidence log: one JSON event per line, config-digest header
   for provenance, size rotation with backups retained.