[ShutenOishi]

Scope — Stage 1 of 13-extension Windows PG14–18 install optimization

Change exactly one line in .github/workflows/windows.yml: central immutable build-extension.yml pin 455f0ccc667697f600700a6e64bcfd6c57b6a977 → 4adc71076283dc9cf64543b760c65b054f5a85f0 (accepted plpgsql_check pilot, central build PR #110). No local installer, candidate, Update Watch, release/signing, or permission modifications. This is a normal pull_request build; no manual workflow_dispatch.

Mandatory fail-closed premerge gates

• Protected main; exact PR head/base; mergeability clean; required Windows required summary GitHub Actions App 15368 SUCCESS with PG14,15,16,17,18 Windows x64, matrix resolver and extension functional smoke.
• Download five new PR-run Windows Artifacts; verify outer and inner ZIP CRC, actual packaged DLL/EXE + extension-specific files, SHA256 and actual files vs SPDX 2.3 SBOM SHA1+SHA256, Grype JSON/scanner database/report-only findings, and PACKAGE-INFO immutable central builder SHA 4adc71076283dc9cf64543b760c65b054f5a85f0 and source PR SHA/Run binding.
• Compare per-PG installer-only and download timings with prior pinned run, report missing/ambiguous timing UNKNOWN. In the accepted pilot PG14/15/16/18 install-step ~65–74% lower than old means, but PG17 download had ~643.5s outlier; network waits are availability warnings, not grounds to bypass integrity/CI checks. No claim of stable speedup without equivalent repeated measurements.
• Merge only with expected-head squash after complete independent acceptance; verify postmerge normal push CI, 5 new Artifacts and PACKAGE-INFO before expanding fleet. Failure STOP, incomplete HOLD.

Tracks Issue #46 and #75. No manual Dispatch, signer canary, Publisher, Release, Tag, protection/permission/Secret/billing changes.