[Zaldaryon]

Follow-up to #189. The preflight there creates the deepest installer path from PowerShell, so it cannot see blocks that judge innoextract.exe itself, such as Controlled Folder Access. This change handles that case instead of stopping the install.

What changes on Windows:

• A staging directory inside a folder that Controlled Folder Access protects is skipped while the feature is blocking (registry value 1). The protected set is Documents, Pictures, Videos, Music, Desktop and Favorites for the user and Public, plus folders added in Windows Security. The state is read from the registry because Get-MpPreference needs a running Defender service and, for the folder list, admin rights.
• bootstrap.ps1 runs the extraction through Invoke-ExtractWithStageFallback. When innoextract exits non-zero, the staging directory is removed and the next location is tried, up to three attempts. If all fail, the error lists each location with its exit code. With Controlled Folder Access on, it also names the Windows Security page (Ransomware protection, Allow an app through Controlled folder access) and the innoextract.exe path to allow.
• Staging candidates that differ only by a trailing separator are one entry. The temp folder and its 8.3 form were listed twice when the user name is short enough that the 8.3 form is the same path.
• scripts/tests/extract-stage-root.ps1 left optimum-ix-* directories in the temp folder after each run. It now removes them.

Testing, on Windows 11:

• scripts/tests/extract-stage-root.ps1 passes under Windows PowerShell 5.1 and PowerShell 7. The new checks cover Controlled Folder Access at 0, 1, 2 and unreadable, protected-folder matching (including a sibling with a shared name prefix), retry order, the attempt limit, cleanup of failed attempts, and the first-attempt error keeping its -VanillaDir advice. Removing the protected-folder skip, the retry, or the exclusion list each makes the suite fail.
• bootstrap.ps1 ran end to end under both hosts against the cached 1.22.7 installer: 122 patches applied, 0 failed, no staging directory left behind.
• With Invoke-ExtractWithStageFallback and the real innoextract 1.13.0, a simulated block on the temp folder made the first attempt fail and the second extract all 20,096 files under D:\.

Not covered: I could not turn Controlled Folder Access on (no admin rights, Defender service not answering), so the block was simulated and the registry read was only checked against an absent key. The 8.3 check in the test is skipped on volumes without 8.3 names, which includes the one I tested on, so the Windows CI run is the first place it executes.