fix(windows): pin upgrade baseline to retained nightly

[me2seeks]

Summary

• replace the pruned v0.1.9 release baseline with the retained v0.2.0-dev.11.20260831 GitHub prerelease installer
• preserve the existing exact SHA-256 verification and GitHub Release as the only download source

Verification

• node scripts/prepare-windows-upgrade-baseline.mjs 0.2.0 <temp-dir>
• node --test scripts/verify-windows-harness.test.mjs
• node --test scripts/ci-test-plan.test.mjs

[Astro-Han]

The pin itself matches what I measured — Maka-0.2.0-dev.11.20260831-win-x64.exe is 0c5362707776af9a6146b55e3284dc0a2389b3329e2bed94cfc386b0eac86709, and node scripts/prepare-windows-upgrade-baseline.mjs 0.2.0 <dir> succeeds with it.

Heads-up though: the manifest alone won't get package green. The download step passes, and then the next step fails, so the run just gets red later.

verify-windows-installer-lifecycle.mjs:424-428 verifies the installed baseline under artifactContract: 'legacy-baseline', which in verify-windows-x64.mjs:149 becomes bundledGitContract: 'legacy-required'. That contract was written for a 0.1.x baseline and requires the bundled Git distribution:

resources/bundled-git.json
resources/licenses/git/LICENSE.txt
resources/licenses/git/SOURCE_OFFER.txt
resources/licenses/dugite/LICENSE
resources/licenses/git/NOTICE.txt
resources/git/cmd/git.exe        # verify-windows-x64.mjs:159

The new baseline postdates #3457, which stopped distributing bundled Git, so it ships none of them. I listed the published Maka-0.2.0-dev.11.20260831-win-x64.zip to check rather than guessing — its resources/ tree has no git/, bundled-git.json, licenses/git/, or licenses/dugite/. assertPackagedResources walks required in order, so the first failure should be an ENOENT on resources/bundled-git.json during Exercise pinned-version upgrade and uninstall.

Two other expectations are worth knowing about before reaching for the current contract instead: this baseline's app-update.yml says channel: dev, not release, and its embedded Runtime Host setup package is maka-agent@0.2.0-dev.11.20260831, not the checkout's 0.2.0. So the reduced baseline contract is still the right shape — it just can't demand Git any more.

I hit the same thing in #4412 and ended up removing the legacy-required branch entirely (it's unreachable now that no published build carries Git) and renaming legacy-baseline to upgrade-baseline. Happy either way — take that part into this PR and I'll close mine, or close this one and review mine. Whichever is less work for you.

[me2seeks]

Closing as superseded by #4412.

#4412 includes the same retained-Nightly pin plus the required upgrade-baseline contract update for builds that no longer carry bundled Git. Its hosted Windows package run passed the complete install, upgrade, uninstall, automatic-update, and rollback path.