Automate CI and verified multi-architecture releases

[JamesLinYJ]

Summary

• add Windows CI for formatting, checks, strict Clippy, tests, and release builds
• keep x86_64 as the primary quality job and add i686 plus ARM64 architecture coverage
• publish x86_64, x86, and ARM64 release assets only after PE architecture, embedded version, size, and SHA-256 verification
• generate SHA256SUMS.txt and GitHub build-provenance attestations
• pin Actions to immutable commit SHAs and enable weekly Dependabot updates

Local verification

• cargo fmt --all -- --check
• cargo check --all-targets --locked
• cargo clippy --all-targets --locked -- -D warnings
• cargo test --all-targets --locked
• cargo build --release --locked
• i686 check, strict Clippy, tests, and release build
• ARM64 check, strict Clippy, and release build
• package validation for all three PE machine types and embedded version resources
• actionlint 1.7.12, YAML parse, PowerShell AST parse, and git diff --check

Co-authored-by: OpenAI Codex codex@openai.com