Presspeech for Windows 0.1.8

Presspeech for Windows 0.1.8 closes the remaining replacement window when an
approved update installer starts and makes Windows release builds more
reproducible.

Fixed

• Immediately before launch, Presspeech now opens the verified installer with
  Windows write and delete sharing disabled, rechecks its size and SHA-256
  through that handle, and keeps the handle open until process creation. The
  approved path therefore cannot be changed between final verification and
  launch.
• Reparse points and directories are rejected by the same locked-file check.

Release integrity

• Release installs now pin the CUDA-enabled Torch build, PyInstaller hook
  bundle, and Inno Setup version explicitly.
• Runtime and CUDA dependency declarations now share one authoritative Torch
  pin, with CI checks that prevent the CPU and CUDA install paths from
  drifting apart.

Speech recognition remains entirely local. Update checks still send no app
version, device details, settings, transcripts, or usage identifiers. This
build is not yet code-signed, so Windows SmartScreen may show Unknown
publisher; choose More info → Run anyway after verifying the supplied
SHA-256 checksum.