fix(dgw): resolve WER APIs dynamically to support Windows Server 2016

[Richard Markiewicz (thenextman)]

WerRegisterExcludedMemoryBlock is absent from wer.dll on Windows Server 2016 RTM (NT 10.0.14393). The static import introduced in v2026.1.1 caused the Windows loader to refuse starting DevolutionsGateway.exe on those hosts with a "procedure entry point not found" error.

Replace the static import with runtime resolution via GetModuleHandleW and GetProcAddress, cached in a OnceLock. The binary now starts on any Windows 10/Server 2016 build and silently skips WER dump exclusion when the API is unavailable; all other protections (guard pages, VirtualLock, PAGE_READONLY) still apply.

⚠️ Authored with Claude, but seems sane to me

Issue: DGW-368

[github-actions]

Let maintainers know that an action is required on their side

• Add the label release-required Please cut a new release (Devolutions Gateway, Devolutions Agent, Jetsocat, PowerShell module) when you request a maintainer to cut a new release (Devolutions Gateway, Devolutions Agent, Jetsocat, PowerShell module)

• Add the label release-blocker Follow-up is required before cutting a new release if a follow-up is required before cutting a new release

• Add the label publish-required Please publish libraries (`Devolutions.Gateway.Utils`, OpenAPI clients, etc) when you request a maintainer to publish libraries (Devolutions.Gateway.Utils, OpenAPI clients, etc.)

• Add the label publish-blocker Follow-up is required before publishing libraries if a follow-up is required before publishing libraries

[Copilot]

Pull request overview

This PR fixes DevolutionsGateway startup failures on older Windows Server 2016 builds by removing a static import of WER APIs that may not exist on those systems, and replacing it with runtime resolution.

Changes:

• Replace static WER imports with runtime GetProcAddress lookup cached via OnceLock.
• Adjust Windows vs Linux tests to account for best-effort WER dump exclusion on Windows Server 2016 RTM.
• Update secure-memory Windows crate feature flags to drop Win32_System_ErrorReporting and add Win32_System_LibraryLoader.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
crates/secure-memory/src/windows.rs	Dynamically resolves WER exclusion APIs at runtime to avoid loader failures on WinServer 2016 RTM.
crates/secure-memory/src/lib.rs	Updates platform expectations in tests: Linux still expects Full protection; Windows validates core protections without requiring dump exclusion.
crates/secure-memory/Cargo.toml	Swaps Windows feature flags to support dynamic symbol lookup (LibraryLoader) instead of static ErrorReporting imports.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Benoît Cortier (CBenoit)]

LGTM!