fix: harden Windows portable upgrades for 0.2.5

[WSL043]

What this fixes

• blocks the offline self-extractor from overwriting any non-empty destination
• makes the lightweight Windows bootstrap perform a version-aware safe full-package upgrade
• keeps an existing install launchable when the update channel is unreachable
• rebuilds the DSH-managed profiles/node_modules fallback during app/full-package updates without deleting profile data, profile-local plugins, sessions, or workspace
• permanently raises both native WebView2 workspace navigation waits from 30 seconds to 60 seconds
• adds focused regression coverage for bootstrap auto-upgrade/offline reuse, managed fallback migration, self-extractor overwrite rejection, and the WebView2 timeout

Why

An offline self-extractor run over an existing DSH-Portable directory can mix a new runtime with durable old profile state. A reported failure then resolved bundled UI plugins from data/dsh-home/profiles/web and failed with ERR_MODULE_NOT_FOUND. DSH normally heals its shared module fallback, so the safe migration boundary is to preserve user profile data but regenerate the installation-owned fallback.

The PR remains draft until the Windows base build, Inno packages, and final product smokes all pass.