fix(provider): match opy release tarballs

[e54-bot]

Summary

• align first-party OPY provider resolution with the published opy-rs v0.1.15 artifact contract
• use .tar.gz for every supported target, including Windows
• extract the top-level opy-provider / opy-provider.exe entry and retain executable mode
• remove the obsolete ZIP dependency and update the Windows regression path

Verification

• downloaded the real opy-rs v0.1.15 Linux and Windows archives and matching .sha256 files; both checksums passed
• exercised the public resolver path from a clean store: latest API -> archive -> checksum -> activation -> offline reuse for Linux and Windows targets
• pre-fix ablation requested the real Windows asset as .zip and failed with HTTP 404
• cargo fmt --all
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test --workspace --all-targets --all-features

The resolver used a local HTTP mirror containing the exact real-release bytes for the end-to-end run because this host's Rust TLS trust store rejects the local proxy certificate (UnknownIssuer); the release assets and checksums themselves were fetched and verified from GitHub.

Refs #244