fix(upgrade): restore Windows release build

[Ivanbeethoven]

Summary

• restore the non-Unix InstallDir API surface with fail-closed unsupported-platform errors, allowing Windows callers to compile without enabling Unix fd-relative upgrade operations
• avoid moving the agent-import root path in the Windows branch
• keep the Unix-only entry-name validator out of non-Unix builds

Root Cause

The upgrade marker, transaction, and orchestrator modules compile on Windows, but InstallDir exposed only open_validated there. Their remaining method calls therefore failed with missing-method errors. Agent import also moved root into a Windows-only binding before a later borrow.

Impact

Windows release builds now compile and retain the intended fail-closed behavior: auto-upgrade file operations remain unsupported outside Unix rather than falling back to path-based filesystem access.

Validation

• cargo +1.97.1-x86_64-pc-windows-msvc build --locked --release --features keyring --target x86_64-pc-windows-msvc with the release workflow RUSTFLAGS
• target\\x86_64-pc-windows-msvc\\release\\libra.exe --version
• cargo +1.97.1-x86_64-pc-windows-msvc build --locked --all-features
• cargo +nightly fmt --all --check
• pnpm --dir web lint
• pnpm --dir web build

cargo test --all was also attempted on Windows. It is currently blocked by pre-existing Unix-only test code compiled without platform guards in opencode_export.rs and utils/object.rs; this is independent of this change and the release target builds successfully.