fix(windows): add Smart App Control safe browser fallback

[cko32002]

Summary

• keep the native Windows browse.exe intact for future signing and release workflows
• stage an exact extensionless Git Bash launcher after Windows builds
• discover a complete gstack source checkout and fail closed when source or dependencies are incomplete
• run the browser client through the installed Bun and Node toolchain without disabling Smart App Control
• add executable regression coverage for Windows staging, non-Windows no-op behavior, source discovery, argument forwarding, and browse.exe preservation

Validation

• bun test test/windows-appcontrol-launcher.test.ts test/setup-windows-fallback.test.ts: 10 passed, 4 skipped, 0 failed
• bash -n on both launchers, build script, and setup: passed
• full Windows Git Bash build: passed
• generated extensionless launcher navigated to a local app with HTTP 200 and returned healthy browser status
• Windows Smart App Control remained enabled throughout the local smoke test
• independent recheck verdict: ACCEPT

Scope

This is a functional fallback for Windows installations where Smart App Control blocks the unsigned Bun-compiled executable. It does not Authenticode-sign browse.exe, and it does not close the signing and release-provenance request in #2124.

The launcher is intentionally Git Bash-only, matching gstack's documented Windows runtime. No .cmd wrapper is installed, which avoids batch metacharacter re-parsing and command-injection risk.

Addresses #2124.

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[time-attack]

@cko32002 Make the launcher discover source checkouts created by the documented Codex installation flow, and add tests for the required Windows behavior.