add native Windows support

[RubenGlez]

What changed

• ship a native Windows x64 binary as a checksum-verifiable ZIP through GoReleaser
• keep Windows ARM64 unpublished until it has native execution coverage
• run build, test and vet on Windows and Linux
• exercise installed hooks under Git for Windows
• keep private files encrypted during Windows checkout, then materialize them only through doctier unlock with a current-user-only, inheritance-protected NTFS DACL
• repair the DACL of existing plaintext without overwriting uncommitted edits
• protect private merge temporaries; on Windows, return encrypted conflict markers to Git and let doctier unlock reveal them securely even with an unmerged index
• provide PowerShell-native setup guidance and document Windows installation, security and release constraints

Why

Git owns the destination of smudge filters and copies merge-driver output into the worktree. On Windows, either operation can create a file with inherited permissions before doctier can apply an owner-only DACL. Returning plaintext from those subprocesses would create an exposure window.

Windows therefore uses a ciphertext handoff. Checkout and conflicted merges leave ciphertext in the worktree; doctier unlock owns the final write, protects the real path first, then writes plaintext.

Windows ARM64 still only cross-compiles, so it is deliberately excluded from release artifacts until native validation exists.

Impact

Windows x64 users can install a checksum-verifiable release ZIP and use doctier with Git for Windows. After checkout, pull or a conflicted private merge, they run doctier unlock to materialize private content securely. Linux and macOS behavior is unchanged. Windows archives are not Authenticode-signed yet.

Validation

• local go test ./... (104 tests), go vet ./... and go build ./...
• Windows x64 cross-build and Windows test-binary compilation
• GoReleaser 2.17.1 configuration check
• actionlint 1.7.12
• native Windows build, test and vet
• real Git for Windows hook rejection
• real secure-checkout test: checkout retains age ciphertext and doctier unlock materializes plaintext behind one protected current-user ACE
• real private-merge test: Git receives ciphertext, doctier unlock reveals conflict markers, and the final file keeps the protected DACL
• successful GitHub Actions run on f12044a