Install and validate Windows user fonts

[jsilverdev]

Summary

• install Cascadia Code and Cascadia Nerd Fonts as part of the Windows baseline, including non-interactive runs
• use native curl.exe and tar.exe for AllSigned-safe download/extraction and compact Nerd Fonts .tar.xz assets
• make per-user font registration idempotent through the HKCU Fonts registry key
• validate downloaded font families, installed files, and HKCU registrations after bootstrap and update
• run the same font validation under normal and AllSigned policies
• document the Windows font baseline and test coverage

This supersedes #7, which exposed the initial AllSigned/validation issues and was rebuilt on the current main.