Windows 安装器：可选生成 CLI service shim

[534A4D21]

Windows bootstrap and installer gain the optional -CreateCliShim switch. It creates cx-codex.cmd next to the launcher, allowing the managed Release CLI to handle commands such as cx-codex service status without an npm global install.

Installation and uninstall both require the CX-Codex ownership marker and the quoted target path before replacing or deleting an existing shim. Foreign commands and empty files remain unchanged with a CLI_SHIM_PRESERVED warning. Repeating the option refreshes the Node command in a managed shim; default installation behavior stays unchanged.

Validation: frontend and CLI builds passed; isolated Windows productization smoke passed, including foreign/empty file preservation, an actual stale Node command upgrade, foreign wrappers mentioning the target, literal bracket-containing paths, install/uninstall JSON, startup health and process-tree cleanup. The empty-file case failed on the prior revision with InvokeMethodOnNull and passes with the fix.

Target beta for candidate verification, followed by a verified beta-to-main PR. No version tag, package publication or production deployment is included.

[Qjzn]

暂不建议合入 main。主要阻塞点：

1. -CreateCliShim 安装路径会无条件 Set-Content 到 %USERPROFILE%.local\bin\cx-codex.cmd，如果用户已有同名命令，会被覆盖。
2. 卸载侧已经有“非 CX-Codex shim 保留”的保护，但安装侧缺少同等级的所有权校验，因此风险不对称。
3. 建议补齐：安装时检测已有 shim；若不是当前 CX-Codex 管理的 shim，则保留并输出 warning，或增加显式 -ForceCliShim 才允许覆盖；同时补一个 smoke 用例覆盖“已有外部 shim 不被覆盖”和“已有 CX-Codex shim 可更新”。

补充：main 的依赖安全告警已通过 #89 组合处理；本 PR 后续 rebase 到最新 main 后再重新跑 CI。

[Qjzn]

已完成复核并补齐修复：空文件保持原样且不再导致安装失败；升级用例实际传入 -CreateCliShim 并验证旧 Node 命令被替换；安装和卸载均按标记与规范化后的命令目标确认归属，覆盖 Windows 短路径和方括号路径。

本地完整 Windows productization smoke 通过。当前提交 1e9bf04 的 CI build、Windows productization、原地升级与清理均通过（run 34226227036）。同意先合入 beta，后续由验证后的 beta 合入 main。