Windows: add fail-closed x64 shipping pipeline

[brxs]

Summary

• add a Windows 11 x64 current-user NSIS package with Start menu integration, WebView2 bootstrap policy, upgrade/downgrade checks, and default-preserving uninstall
• add explicit marker-guarded data purge with path and size disclosure, plus hosted installer lifecycle coverage for Unicode, spaces, and long-path-disabled systems
• add provider-neutral fail-closed Authenticode signing and verification, a required Windows release producer, and a single least-privilege publisher
• add a managed backend launcher seam that never falls through to system Python, uv, Git, CUDA toolkit, WSL, or a shell
• document Windows operations, Defender/SmartScreen response, and the physical release qualification checklist

Validation

• Python release and packaging contract suite: 26 passed
• cargo test --locked --workspace: app 271 passed / 2 ignored; engine 116 passed
• cargo check and cargo clippy with managed-backend: passed
• Tauri no-bundle build using the Windows config and managed-backend: passed
• JSON/YAML/config and diff checks: passed
• exact hosted run 31333418976 passed at 39a480b2d512c6883ef2d3afa6d0f62f684434d4 on Ubuntu, macOS, and Windows
• the hosted Windows job built both unsigned installers, proved unsigned release verification fails closed, passed the install/upgrade/downgrade/uninstall lifecycle (including Unicode and space paths), and uploaded the development artifact

Integration status

This focused lane has been integrated into the combined cross-platform review branch in #131. This PR remains available as the narrow Windows implementation and validation record.

Deliberate release gates

This is a draft and does not claim Windows hardware qualification or a signed artifact. A Windows release remains blocked until the project selects an Authenticode provider/certificate and protected CI identity, completes Defender/SmartScreen validation, and qualifies physical Windows 11 NVIDIA/WASAPI/FLX4 hardware. Runtime/model completion remains owned by #110 and #111; licensing completion remains owned by #108.

Implements the non-hardware shipping slice of #113. Built on #107.

[brxs]

Superseded by and fully consolidated into #131. The combined branch includes this lane's substantive changes, subsequent integration fixes, and exact-head cross-platform validation. Please continue review in #131.