feat: depend on bash; MSYS2 is the supported Windows bash

[capocasa]

3code depends on bash. On Windows, the installer drops a private MSYS2 into
`%LOCALAPPDATA%\3code\msys64` so 3code owns its bash + unix toolset
deterministically (no system-root probing, no PATH fallback, no WSL-launcher
risk). `resolveBash` looks at the bundle, then a config `bash_path` override,
then hard-fails at startup.

Source (compiles out on POSIX via `when defined(windows)`):

• `streamexec.nim`: `resolveBash`/`bundledMsys2Bash` + Windows launcher branch
• `threecode.nim`: `ensureBash()` guard after `refuseRoot()`
• `config.nim`: `bashPathOverride` global + `bash_path` setting
• `test_streamexec.nim`: Windows suite (no-bundled-bash contract)

Installer (`3code.capocasa.dev`, separate): one command for fresh install

• update. Fresh: GitHub API resolves the sfx asset (the
  `/releases/latest/download/` stable URL is broken for dated releases,
  404 with https://github.com/msys2/msys2-installer/releases/latest/download/msys2-base-x86_64-latest.sfx.exe which used to work msys2/msys2-installer#118), extracts into the app dir. Re-run: `pacman -Syu`.

CI: adds `windows.yml` (fast Windows-only build+publish, mirrors `osx.yml`).
This PR triggers the full `release.yml` matrix via `pull_request`, including the
windows-latest leg.

Cross-compile of `streamexec.nim` + `test_streamexec.nim` passes under
`--os:windows`. Linux build + tests green.