fix(windows): unswallow installer failures, quote CreateProcessW args, document MotW

[DeusData]

Closes #697.

Distilled from #702 (thanks @ShauryaaSharma — credited via Co-authored-by).

What

Three Windows installer failures from #697, plus UTF-8-correct argument widening:

1. Mark-of-the-Web silently blocks install.ps1 — README now documents Unblock-File .\install.ps1 in both install paths, plus the Set-ExecutionPolicy -Scope Process Bypass escape hatch.
2. Agent-configuration failures were swallowed — install.ps1 wrapped codebase-memory-mcp install -y in a try/catch that caught nothing useful (native commands don't throw) and printed "non-fatal". It now checks $LASTEXITCODE, reports the exit code, and fails the installer so users aren't left with a binary but no configured agent.
3. taskkill /FI "IMAGENAME eq codebase-memory-mcp.exe" argument splitting — cbm_exec_no_shell used _spawnvp, whose CRT concatenates argv without quoting, so the filter arrived as three bare tokens (ERROR: Invalid argument/option - 'eq'). It now builds an MSVC-convention quoted command line (cbm_build_cmdline, two-pass sizing + write, exposed for tests via compat_fs_internal.h) and spawns via CreateProcessW.
4. UTF-8-correct widening — the quoted command line is assembled in UTF-8 bytes and converted once via the existing cbm_utf8_to_wide, so non-ASCII arguments (e.g. paths under a non-ASCII %USERPROFILE%) survive intact instead of being byte-widened as Latin-1 mojibake.

Tests

Windows-only additions to the security suite (exercised by the Windows CI leg):

• cmdline_taskkill_filter_is_single_quoted_token — the exact Windows: install.ps1 reports success but leaves MCP server unregistered (MotW + swallowed config errors + malformed taskkill) #697 regression.
• MSVC quoting edge cases: bare args, single arg, empty arg (""), embedded quote, trailing backslashes before the closing quote, empty argv.
• cmdline_utf8_arg_is_widened_not_latin1 — UTF-8 C3 A9 must collapse to U+00E9, not survive as two Latin-1 code points.
• cmdline_utf8_multibyte_roundtrips_via_utf8_to_wide — mixed 2-byte umlaut + 3-byte CJK argument round-trips identically to cbm_utf8_to_wide of the same fully-quoted UTF-8 command line; fails on Latin-1 byte-widening.
• Live CreateProcessW spawn tests (cmd /c exit 0/42, NULL argv).

Verification

• macOS: make -f Makefile.cbm cbm (-Werror clean), lint-ci green, security suite 34/34 (Windows-only tests compiled out; POSIX exec path unaffected — all C changes live inside the #ifdef _WIN32 branch).
• The quoting/widening tests themselves run on the Windows CI leg; on the pre-fix Latin-1 widening (wchar_t buffer written byte-by-byte) both UTF-8 tests fail, on the cbm_utf8_to_wide path they pass.