Make Windows CI verify pinned dependencies and report supported tests

[Cengokill]

Summary

Rebase the Windows CI branch on current main and make dependency acquisition and test reporting trustworthy. The earlier workflow caught and ignored an ONNX model hash mismatch, then accepted file existence even though the application requires the exact pinned model.

Implementation

• Build libheif/libde265 from pinned source commits. Permit only these source-built codec DLLs to differ from the packaged hashes; ONNX Runtime DLLs remain strictly hash-checked.
• Extract the v0.1.8 portable release's ONNX model and verify its SHA-256 against dependencies/imaging/lock.json. Fetch and verify the pinned test images and ICC profile; generate EXIF/ICC import fixtures with the already-pinned Pillow requirement.
• Key the dependency cache by both lock files, avoid stale fallback caches, and fail on bootstrap or native command errors.
• Run the Windows CI CTest preset, excluding only interactive tests, the six documented known_failure tests, and external_fixture input-resize tests whose frozen corpus is absent from Git. Other failures still fail the job. Document these limitations separately from the full local Release suite.

The branch was rebased on main at 7aaf842b; its earlier iterative commits were consolidated into one reviewable CI commit followed by targeted fixture and formatting fixes.

Verification and current limitations

• Static checks: git diff --check origin/main...HEAD, JSON parsing of CMakePresets.json, and workflow YAML parsing passed locally.
• GitHub Actions run 38938114090: dependency bootstrap, fixture generation, CMake configuration, Compositor build, and all test-target builds passed. CTest passed 940/951; imports.ui passed after the fixture fix. The job remains failed because 11 application tests fail.
• Remaining failures: drop_sequence.closed_captured_destination_skips_images, project_open_batch.welcome_project_then_image_skipped, layer_panel.visibility_swipe, command_integrated.registered_actions, remembered_settings.lasso_return, remembered_settings.crop_ratio, ui.pending_interactions, retouch_sparse.smudge_preview, retouch_sparse.liquify_preview, cancellation.adjustment_contracts, and palette_swatches.stroke_disabled. They exercise unchanged application code; this CI PR does not relabel or hide them. Their application behavior needs separate investigation.
• The current head includes only a subsequent whitespace cleanup to the workflow; its new GitHub Actions run is pending. No local Windows desktop is available to launch the application. The unfiltered Release suite, interactive native dialogs, and external input-resize corpus have not been claimed as passing.

This PR changes CI, documentation, and test labeling, not the native project format or application behavior.