fix: harden protected Windows release bootstrap

[Chris-ObtuseAI]

Outcome

Ships the v0.9.2 protected Windows setup correction after the v0.9.1 installer failed closed without moving state or enabling authority.

Corrections

• pin canonical Windows PowerShell modules before manifest verification
• compute bootstrap SHA-256 through .NET instead of module-dependent Get-FileHash
• determine native command success by exact exit code despite benign stderr
• reject Windows reserved-device payload path segments and replace payload/aux
• rebind nested packaged-smoke evidence to the relocated native artifact and recompute its derived digest
• support exact verified v0.9.1-to-v0.9.2 legacy desktop retirement
• update the release runbook, audit response, manifests, and all package versions

Validation

• 1561 passed, 10 skipped, 463 subtests passed
• focused installer/release suite: 79 passed, 5 subtests passed
• UI: 107 passed; npm audit: zero vulnerabilities
• Ruff, uv lock, Cargo metadata, PowerShell AST, and diff checks: PASS
• polluted PowerShell module-path/native-stderr Windows regression: PASS
• projects/**: unchanged

No live execution, provider calls, credentials, or runtime-state changes are part of this PR.