fix(desktop): harden Windows installs against Defender block and orphaned Node

[wpfleger96]

This PR fixes two Windows-specific install failures: Windows Defender blocking the bare irm|iex PowerShell install command, and managed Node shims pointing at a version-bumped (now-absent) Node directory.

The Defender block (Trojan:Win32/Commando.A!ml) fires before PowerShell runs and is not clearable via Allow. The Node orphaning means shims in the managed npm prefix resolve but fail at runtime with 'node not recognized' because they reference the deleted old Node path.

• Replace all three Windows CLI install commands (Goose, Claude, Codex) with a two-step shape — Invoke-RestMethod to a named temp file, then execute — to eliminate the dropper signature; a new windows_install_command! macro in discovery/windows_install.rs generates all three strings at compile time so the shape cannot drift between runtimes
• $ErrorActionPreference='Stop' aborts on download failure instead of falling through to a missing-file exit-0; exit $LASTEXITCODE propagates the vendor script's own exit code
• Add probe_node(executable, expected_version, timeout) as a bounded seam: stdout goes to a temp file (not a pipe) so no exit path can block on an inherited handle; the child runs in its own process group on Unix so an unconditional group SIGKILL on every exit path terminates all descendants; on Windows taskkill /T /F provides the same tree-wide cleanup; managed_node_runtime_ready() is a thin wrapper that resolves the managed Node path and calls the seam
• Add resolve_adapter_path() in managed_node.rs: resolves the candidate first, then calls should_invalidate_adapter() — a pure predicate that returns true only when the resolved path is under buzz_managed_npm_bin_dir() AND the managed Node runtime is orphaned; external adapters outside the managed prefix are always preserved

Note: CI cannot reproduce the Defender block (no live Defender ML classifier). Proof of fix is structural — the command shape no longer matches the dropper signature. Canary validation on a real Windows machine with Defender enabled is the definitive check.

[Chessing234]

defender eating the windows install is a real footgun — hardening that path is overdue. will be curious how the orphaned-node cleanup behaves on a dirty upgrade.