ci(release): publish verified Windows artifacts

[DTALEX66]

Release contract PR

Scope

Adds a tag-only Windows GitHub Release workflow and artifact-side release identity. The tracked source manifest remains explicitly unreleased; only a verified bundled runtime identity makes an installed product report released and public_installer=available.

Controls

• Tag must target the current origin/main SHA.
• Identity is injected into the exact Tauri resource root before NSIS build.
• Runtime rejects missing, malformed, foreign-repository, tag-mismatched, or CI-run-mismatched identity.
• NSIS lifecycle validates installed release identity.
• Wheel, NSIS installer, identity, and SHA-256 manifest are published; the checksum manifest covers every payload except itself.

Local evidence

• tests/test_release_manifest.py: 14 passed
• Ruff: passed
• git diff --check: passed

Risk and rollback

The workflow is tag-only and does not modify the existing required CI workflow. Rollback is to remove the release tag/release and revert this commit; no user runtime data is changed by the workflow before the installer lifecycle test, which performs uninstall cleanup.