feat(core,tooling): Windows support — shell selection, install.ps1, win-x64 release package, Windows CI (#79)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -1,6 +1,7 @@
 # CI: build -> style (Prettier) -> typecheck (tsc) -> unit tests (vitest) -> live e2e (DeepSeek).
 # Build first: core's exports point at dist/, and cli's type resolution and runtime imports both need core's build output.
 # e2e needs the repo secret DEEPSEEK_API_KEY; when absent (e.g. forks) that step self-skips and the other checks run as usual.
+# A second job repeats build/typecheck/test on windows-latest (see ci-windows below).
 name: CI
 
 # Limit triggers to avoid duplicate runs: push runs only on main/dev; PRs always run once (no target-branch filter --
@@ -55,3 +56,55 @@ jobs:
             exit 0
           fi
           pnpm test:e2e
+
+  # Windows: the same build/typecheck/test gates on windows-latest (the ubuntu job above stays the
+  # required one). The runner ships Git-Bash on PATH, so core's exec_command tests run through the
+  # shell resolver's bash pick; genuinely POSIX-only tests skip themselves via process.platform
+  # guards (not CI filters), so local Windows devs see the same behavior. Line endings come from
+  # .gitattributes (LF working tree), keeping build outputs and fixtures byte-identical.
+  # No format:check (same files as ubuntu) and no live-LLM e2e here (ubuntu-only budget).
+  ci-windows:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      # pnpm version comes from package.json's packageManager field.
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build (tsup)
+        run: pnpm build
+
+      - name: Typecheck (tsc)
+        run: pnpm typecheck
+
+      - name: Unit tests (vitest)
+        run: pnpm test
+
+      # The Linux job cannot validate PowerShell syntax; parse (never execute) the installer
+      # scripts with the real PowerShell parser so a broken install.ps1 cannot ship.
+      - name: Parse installer scripts (PowerShell)
+        shell: pwsh
+        run: |
+          $failed = $false
+          foreach ($f in @("install.ps1", "packages/landing/public/install.ps1")) {
+            $tokens = $null
+            $errors = $null
+            # .Path: hand ParseFile a plain string, not a PathInfo object.
+            [System.Management.Automation.Language.Parser]::ParseFile((Resolve-Path $f).Path, [ref]$tokens, [ref]$errors) | Out-Null
+            if ($errors.Count -gt 0) {
+              $failed = $true
+              Write-Host "${f}: $($errors.Count) parse error(s)"
+              $errors | ForEach-Object { Write-Host "  $($_.Extent.StartLineNumber): $($_.Message)" }
+            } else {
+              Write-Host "${f}: OK"
+            }
+          }
+          if ($failed) { exit 1 }