ci: add Windows (x86_64-pc-windows-msvc) CLI release binary

[madmax983]

Before / After

Before: the CLI release workflow ships only Linux-musl (x86_64 + aarch64) and macOS (x86_64 + aarch64) binaries. Windows users have no download — they must build from source.

After: a native windows-latest matrix leg publishes autumn-x86_64-pc-windows-msvc.zip + its .sha256 checksum on each tagged release, plus a scripts/install.ps1 PowerShell installer (the Windows counterpart to scripts/install.sh).

How

• Native windows-latest matrix leg (cross: false) for x86_64-pc-windows-msvc — proven buildable since autumn-cli already passes cargo test --workspace on windows-latest in ci.yml; cross is Linux-container-only, so Windows builds natively.
• .zip packaging via PowerShell (Compress-Archive — Git-bash on windows-latest has no zip) with a sha256sum-format checksum from Get-FileHash. The existing tarball step is gated if: runner.os != 'Windows', and the artifact/release-upload steps use a autumn-<target>.* glob so both .tar.gz and .zip assets are covered. fail-fast: false and the workflow_call/workflow_dispatch + release.yml coupling are unchanged.
• scripts/install.ps1 downloads the zip from Releases, verifies the sha256, extracts autumn.exe to %LOCALAPPDATA%\autumn\bin, and prints PATH guidance (-Version / -Dir overrides). README gains a Windows install subsection.

Part of #2005.

Validation pending: needs a windows-latest run of cli-release.yml via workflow_dispatch (artifact-only) to prove packaging — runners are starved today; keep draft until green.

---

Generated by Claude Code

[gemini-code-assist]

Code Review

This pull request introduces a new PowerShell installer script (scripts/install.ps1) and updates the README.md with instructions for installing prebuilt Windows binaries. Feedback on the script includes a critical recommendation to avoid using setx PATH due to potential truncation and path pollution risks, suggesting a safer .NET registry method instead, along with normalizing paths to prevent false negatives. Additionally, it is recommended to explicitly enable TLS 1.2 to ensure compatibility and prevent connection failures on older Windows environments.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

Using setx PATH ... with $env:PATH is highly discouraged and dangerous for two reasons:

1. Truncation: setx has a strict limit of 1024 characters. If the combined PATH exceeds this limit, it will silently truncate the PATH, corrupting it.
2. System Path Pollution: $env:PATH contains both User and System paths. Using setx PATH writes all of these into the User-level PATH variable, duplicating them and quickly exceeding the 1024-character limit.

Additionally, comparing paths directly without normalizing trailing backslashes can lead to false negatives (e.g., if PATH contains ...\bin\ but $Dir is ...\bin).

We can resolve both issues by normalizing the paths and recommending the safe .NET registry method for persisting the user PATH.

    $pathEntries = ($env:PATH -split ';') | ForEach-Object { $_.TrimEnd('\') }
    $normalizedDir = $Dir.TrimEnd('\')
    if ($pathEntries -notcontains $normalizedDir) {
        Write-Host "autumn-install: note: $Dir is not on your PATH."
        Write-Host "  Add it for the current session:  `$env:PATH = `"$Dir;`$env:PATH`""
        Write-Host "  Or persist it for your user:"
        Write-Host "    [Environment]::SetEnvironmentVariable('Path', [Environment]::GetEnvironmentVariable('Path', 'User') + ';$Dir', 'User')"
    }

[gemini-code-assist]

On older Windows clients (such as Windows 10 or Windows Server 2016 running Windows PowerShell 5.1), TLS 1.2 is often not enabled by default for .NET network connections. This can cause Invoke-WebRequest to fail with SSL/TLS connection errors when downloading from GitHub. Explicitly enabling TLS 1.2 at the start of the script ensures compatibility.

$ErrorActionPreference = 'Stop'
Set-StrictMode -Version Latest
[Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12