Safely integrate Windows WeChat snapshot reader

[mcncarl]

Maintainer takeover of #14 to finish the contribution without another contributor revision round.

This branch preserves the original contributor-authored commit fe589d60d719a5304469b583cf1a48e863a8348d and adds a separate maintainer hardening commit.

Key changes:

• fail closed on snapshot overlap, unsafe links/reparse points, SQLite sidecars, unsupported schemas, and non-UUIDv4 snapshot IDs
• bound Zstandard window/output, decoded bytes, scanned rows, and result size
• mark snapshot content as untrusted data and neutralize exported Markdown
• bind Windows CI to the exact PR head and lock the CPython 3.12 Windows AMD64 dependency artifact
• accurately document experimental schema compatibility and provenance

Local verification:

• Python 3.12 synthetic tests: 21/21 passed
• Skill quick validation passed
• workflow YAML, SBOM JSON, diff check, and Windows wheel SHA-256 verification passed
• independent final security diff review: complete, 0 findings

Merge only after the exact-head windows-2022 job succeeds. Use a merge commit so the contributor commit and authorship remain in history.