Support --cli-install=binary on Windows runners #657

Context

--cli-install=binary (#653) verifies releases with keyless cosign on linux only; the emitted install is a bash script and pins cosign for linux arches. Windows runners are not supported by binary mode today (see #654).

Ask (demand-gated)

Support binary mode on Windows runners. Unlike macOS (which needs only extra checksum pins, see the companion issue), Windows is a larger lift because the emitted step rides the default shell and the scripts are POSIX bash:

1. Emit shell: bash on the binary-mode step (Git Bash is present on GitHub-hosted Windows runners) so setup_cli_binary_preamble.sh + install.sh run at all. action mode is unaffected.
2. Handle the Windows specifics in the scripts: the cosign asset is cosign-windows-amd64.exe (pin its checksum; for v2.4.3 a2ac24e197111c9430cb2a98f10a641164381afb83df036504868e4ea5720800), the binary is cascade.exe, and the install dir / PATH differ from /usr/local/bin.
3. A windows-safety pass on both scripts (path separators, install availability, archive extension).

Alternative if the cosign path is too invasive on Windows: use a per-platform method. gpg verification of the published checksums.txt.asc (key already shipped at docs/cascade-release-public-key.asc) is cross-platform and needs no cosign binary; it gives integrity + key-holder authenticity but not workflow-identity provenance. The install method can legitimately differ per platform.

Add Windows legs to cli-install-selftest.yaml asserting the chosen verification actually ran. Update the --cli-install docs.

Priority

Lowest of the platform extensions: needs a consumer who runs cascade-generated workflows on Windows runners AND needs allowlist-free install. Defer until that demand is real.