test(windows): define PowerShell installer contract first

[huangzesen]

Summary

This draft PR starts deliberately RED: it adds the native-Windows PowerShell installer contract before adding install.ps1.

• run the same offline contract suite on GitHub-hosted windows-latest under Windows PowerShell 5.1 and PowerShell 7
• isolate HOME / USERPROFILE / LOCALAPPDATA / TEMP / TMP and all install outputs under a spaced test root
• build genuine Windows PE fixture binaries offline from a tiny stdlib-only Go program
• define public seams for version, bin/global directories, local archive + checksum overrides, venv skipping, PATH suppression, and dry-run
• assert checksum and required-binary failures, exact version verification, idempotency, complete-tree no-write dry-run, nonzero exit propagation, -SkipVenv, and -NoModifyPath

Why RED first

install.ps1 is intentionally absent in this commit, so both Windows jobs should fail at the explicit installer-present precondition. Once that VM evidence proves both PowerShell hosts parse and execute the real suite, the next commit will add the smallest implementation that satisfies these contracts.

This ordering follows the human instruction to test first and avoids reviving the closed experimental PR #607 as unverified current code.

Current distribution boundary

• latest public Lingtai-AI/lingtai release v0.11.4 has no binary assets
• latest public kernel release v0.17.1 already includes Windows amd64 wheels
• the final installer must therefore fail loudly for unavailable TUI release assets or use a separately proven source/artifact path; it must not fabricate a public binary URL

Validation before push

• exact baseline: 1f067242698e24b3959df842d2d9a5f0e4a5054d == origin/main
• RED commit: f9008fd63476878b9cdc2d39766827d9b3854cd8
• YAML parse, whitespace/static contract checks: PASS
• parent cross-built the embedded fixture logic to a genuine PE32+ executable (console) x86-64, for MS Windows: PASS
• local macOS pwsh: unavailable; native parser/execution evidence is intentionally delegated to the two Windows CI jobs

Not authorized / not part of this step

No merge, release, deploy, website change, or direct-main push. The later lingtai-web PR remains a separate follow-up and must stay open/unmerged.