fix(distribution): align Windows installer with R2

[Teakowa]

Summary

• make install.ps1 use https://releases.wrightkit.dev/wright as the canonical Wright distribution base instead of GitHub Release/API URLs or the old root-level R2 layout
• resolve latest Windows installs through /wright/latest/version, then download the archive/checksum from immutable /wright/releases/<version>/ paths
• use the same <repo>/latest/version and <repo>/releases/<version>/... URI structure already used by opy-rs
• use the same immutable artifact path for pinned and latest installs; /latest/<artifact> and /wright/latest/<artifact> are not part of the supported contract
• keep the Windows installer zero-extra-dependency for release transport and validate the production R2 transport path on windows-latest
• update the hermetic Windows installer fixture while preserving missing-version, checksum-failure, and native smoke coverage

Verification

• hermetic validation covers pinned/latest path resolution, missing versions, checksum rejection, and native post-install behavior
• the latest fixture must resolve /wright/latest/version but only provide the artifact/checksum under /wright/releases/<version>/, so the test fails if the installer depends on a latest-artifact alias
• the existing Windows distribution CI leg provides production releases.wrightkit.dev transport evidence in addition to hermetic coverage

Fixes #284
Depends on #283

[Teakowa]

Blocker: the R2 path migration is correct, but the Windows installer still uses an HTTP/1.1 transport by default, so it remains incompatible with the current releases.wrightkit.dev policy that rejects HTTP/1.0/1.1.

[Teakowa]

Blocker: the namespaced URI shape is now correct, but the cutover is not yet safe for already-released installers. This PR changes future R2 publication to only advance /wright/latest/version and publish /wright/releases/<version>/..., while the currently released installer still resolves the old root-level latest contract. #283 explicitly requires a safe cutover for existing released installers. Ensure the namespaced publication/cutover is in place without stranding those existing clients before relying exclusively on /wright/...; the old root-level route does not need to remain the durable contract.

[Teakowa]

Follow-up correction: the previous cutover blocker is withdrawn. This change leaves the already-published root-level objects intact; existing legacy installers therefore remain able to install the last legacy release, while future releases move exclusively to the /wright/... contract. #283 does not require the old latest surface to keep advancing as a second supported distribution route. No additional compatibility dual-publish is required.

[Teakowa]

Blocker: the Windows transport finding is fixed. CI now reaches https://releases.wrightkit.dev/wright/latest/version through the new WinHTTP HTTP/2 path and receives HTTP status 404; the hermetic Windows installer validation passes. The remaining failure is deployment ordering: this PR consumes /wright/... while the #283 publisher change that creates that production namespace is still only inside the same unmerged PR.

Satisfy the declared Depends on #283 ordering instead of weakening the smoke or adding a legacy fallback: land the publisher-side /wright/releases/<version>/... + /wright/latest/version contract first, publish/verify it in production, then rebase this consumer change and rerun the existing Windows production smoke. Once that smoke passes, there is no remaining review finding.

[Teakowa]

LGTM