Add click-through Windows COW support to trunk

[adamziel]

What it does

Applies the Windows-native COW work to current trunk.

On Windows, ForkPress can use ReFS block cloning through FSCTL_DUPLICATE_EXTENTS_TO_FILE when a site lives on clone-capable ReFS/Dev Drive storage. This PR also adds the click-through setup path: ForkPressSetup.exe installs ForkPress, prepares the Dev Drive, initializes a first site, and creates a Start ForkPress Site shortcut.

The intended fresh laptop flow is:

1. Download ForkPressSetup.exe.
2. Open it and accept UAC.
3. Reboot only if Windows asks.
4. Open Start ForkPress Site.

This keeps #35 intact and opens a fresh trunk-based PR for the same direction.

Refs #34 and #6.

Rationale

A normal Windows laptop starts on NTFS, where ForkPress cannot cheaply create COW branches. The product path should not ask users to install WSL, Docker, FUSE, WinFsp, Dokany, or a developer storage stack.

The installer creates a ReFS/Dev Drive VHDX instead:

%ProgramData%\ForkPress\Storage\forkpress-dev-drive.vhdx
  mounted at %USERPROFILE%\ForkPressDevDrive

ForkPress projects under that mount get ordinary Windows paths plus ReFS block cloning. On Windows, forkpress init fails closed if the current directory cannot block-clone instead of silently creating huge full-copy branches on NTFS.

Implementation

• Adds Windows file cloning with FSCTL_DUPLICATE_EXTENTS_TO_FILE, including ReFS cluster alignment and chunk handling.
• Packages the Windows PHP runtime as bin/php.exe plus its DLL/ext tree.
• Adds a Windows release lane that builds forkpress.exe, packages a zip, and creates ForkPressSetup.exe with Inno Setup.
• Bundles the VC++ redistributable into the Windows package.
• Installs protected program files under %ProgramFiles%\ForkPress.
• Stores the persistent VHDX under protected %ProgramData%\ForkPress storage.
• Rejects reparse-point storage paths and rejects pre-existing VHDX files unless they were already protected before setup.
• Registers auto-mount with a fixed encoded System32 PowerShell command, not a mutable script file.
• Fails tagged Windows releases if signing secrets are missing, and signs Windows artifacts when WINDOWS_CODESIGN_CERT_BASE64 and WINDOWS_CODESIGN_PASSWORD are configured.

Testing instructions

Local checks run on this trunk-based branch:

FORKPRESS_RUNTIME_BUNDLE=/dev/null cargo test --workspace
FORKPRESS_RUNTIME_BUNDLE=/dev/null cargo check -p forkpress-cli --target x86_64-pc-windows-msvc
npx --yes prettier --check .github/workflows/ci.yml .github/workflows/release.yml
actionlint .github/workflows/ci.yml .github/workflows/release.yml
git diff --check

The Windows release workflow also smoke-tests the packaged artifact on windows-latest by extracting the zip, running packaged forkpress.exe --version, running packaged install.ps1 against a CI ReFS VHDX, confirming an initialized site exists, and running forkpress storage status against that installed site.

Manual release validation should still include one real fresh Windows 11 x64 laptop click-through of the signed ForkPressSetup.exe, mainly to verify SmartScreen/reboot/shortcut behavior outside GitHub Actions.