Improve Windows startup by shipping the PyInstaller onedir bundle

Summary

Implementation follow-up to #5848. Ship the Windows release as a complete PyInstaller onedir bundle instead of onefile, and update installation, upgrade, and uninstall handling for the multi-file layout.

This issue is Windows-only. It does not close or claim to resolve #5844, whose scope is the separate Unix cURL startup path.

Evidence

Native Windows ConPTY measurements showed that packaging mode is the dominant measured factor:

Build / run	Warm time-to-prompt
PyInstaller onefile investigation result	37.22s median
PyInstaller onedir investigation result	7.78s median
Earlier onedir validation	7.78-8.14s
Final onedir validation artifact	13.30s median

The final warm runs were 13.30s, 12.42s, and 15.02s after one discarded 18.16s launch. Removing Python launchers from the child PATH did not materially change either packaging mode, so Python discovery is not the explanation for the onefile delay.

Defender remained enabled throughout testing and no exclusions were added. The evidence supports onefile extraction/initialization as the main packaging-mode cost, but does not establish Defender as a root cause.

Scope

• Build Windows x64 releases with PyInstaller onedir.
• Preserve the existing Windows release asset names and checksum files.
• Archive and smoke-test the complete opensre directory, including _internal.
• Install bundles under an isolated versioned application directory with a stable launcher.
• Stage and verify updates before atomically switching the active version.
• Preserve compatibility with and migrate historical flat onefile installations.
• Make update and uninstall safe around Windows file locking and multiple running OpenSRE processes.
• Preserve unrelated files and fail closed when ownership or process state cannot be proven.
• Direct Git Bash users to install.ps1 rather than installing an incomplete Windows layout.
• Do not change macOS or Linux packaging behavior.

Acceptance criteria

• Windows release CI builds and packages the complete onedir tree under the existing asset name.
• The raw and extracted release bundles pass version, help, and package smoke tests.
• Clean install, onefile-to-onedir migration, onedir upgrade, update with another shell running, and uninstall are covered.
• Failed activation or cleanup leaves the previous working installation and user data intact.
• Coexisting unowned launchers or executables prevent user-data deletion.
• Paths containing spaces and quoted launcher arguments work.
• Focused installer, packaging, update, uninstall, sandbox, capability, and Python-tool tests pass.

Remaining performance and validation caveats

• The final 13.30s warm median remains variable and is within the broader 7-14s range that motivated the startup investigations. The onedir change removes the much larger onefile penalty but does not explain all remaining startup cost.
• The successful released-onefile migration and authenticated setup validation used the product-identical pre-rebase artifact. The exact post-rebase onefile harness was inconclusive; focused migration regressions pass on the final source.
• CI remains authoritative for the repository-wide test matrix.