Add secure Windows launcher and deterministic release pipeline

[Ancalgonn]

What changed

• adds the Windows WPF launcher with signed-manifest verification, progress reporting, importer integration, side-by-side self-update, rollback, downgrade protection, and installed-file identity checks
• adds the deterministic Windows release workflow, code-only Godot export firewall, release artifact scanner, manifest signing, provenance, and fail-closed clean-VM acceptance job
• adds deterministic importer/reproducibility contracts for models, textures, animations, audio, maps, rules, and UI output
• publishes the current simulation engine and its deterministic contract tests required by public CI
• rewrites the README and supporting docs around a BFME2-first scope using Completed, In progress, Not started, and Out of scope states
• documents launcher use, releases, and Windows VM runner setup

Why

OpenBFME is ready for a public playtest-oriented distribution path, but releases need to remain reproducible, legally clean, and fail closed when the expected game export or locally imported BFME2 assets are not verified. This PR establishes that boundary without publishing retail assets or private development material.

Publication boundary

The branch contains exactly the approved 86-file public manifest based on public GitHub main. It excludes .private, game packs, retail/converted payloads, AGENTS.md and agent workflow files, credentials, private keys, personal paths, binaries/build output, the local banner LFS artifact, and the in-progress game/UI rewrite.

Validation

• public export personal-path/key and forbidden-file scans: pass
• export firewall self-test and public game-tree scan: pass (182 files)
• npm install/audit: 0 vulnerabilities
• environment-independent launcher protocol test: pass
• importer: 1,276 passed, 126 skipped, 915 subtests passed
• simulation engine: 61 passed
• launcher security/update/rollback: 13 passed
• import reproducibility comparator: 4 passed
• release pipeline firewall/contracts: pass
• Godot 4.7 code-only Windows export and exported executable smoke: pass during final candidate validation
• two independent local packaged-launcher imports produced the same 225-file pack digest during final candidate validation

Remaining release blockers

This PR intentionally does not create a tag or public release. A dedicated clean Windows acceptance runner still needs to complete the All-In-One-Launcher BFME2 import plus exported-game launch acceptance. Windows executables also still need a trusted Authenticode signing certificate/service. The release workflow fails closed until the Windows VM acceptance job succeeds.