fix: harden Windows installer smoke recovery

[numnx]

What changed

• retry only the known transient Windows NSIS 0xC0000005 termination with bounded 1.5s, 5s, and 15s backoff
• use a fresh installation destination for every attempt while failing all other installer errors immediately
• document the release-candidate behavior in canonical and public docs

Why

The final 0.9.10 release candidate produced a valid Windows installer, but GitHub runner host inspection terminated the installer twice immediately after packaging. A preceding green run recovered from the same status on its second attempt, showing that the previous single quick retry was too narrow for this runner-level transient.

Validation

• node_modules/.bin/vitest run tests/backend/electron-builder-config.test.ts tests/backend/ci/workflow-health.test.ts (20 passed)
• node_modules/.bin/tsc --noEmit --incremental --tsBuildInfoFile .cache/tsc/root.tsbuildinfo
• node scripts/build.mjs
• node scripts/sync-docs-web.mjs --check
• node --check scripts/smoke-installed-electron.mjs

The direct project binaries were used locally because the existing pnpm wrapper stops on the unrelated local electron-winstaller build-approval state. CI installs from a clean environment and remains authoritative.

Risk / rollback

Low risk: recovery is limited to the exact observed access-violation status and adds at most 21.5 seconds before a definitive failure. Revert this PR to restore the previous two-attempt behavior.

[numnx]

The first manual native diagnostic exposed an additional workflow defect before the installed-app step: trailing --publish never arguments were forwarded through a compound electron:dist:* script and never reached Electron Builder, so CI auto-detection attempted an unauthorized GitHub publish. Commit 719587911 now makes both desktop diagnostic workflows call Electron Builder directly with explicit targets and --publish never; workflow-health coverage and docs pin the artifact-only contract.