fix(security): complete Windows tirith install support

[XiaoXiao0221]

What does this PR do?

This PR fixes Windows auto-install support for the tirith_security tool.

On Windows, tirith releases use .zip archives and install tirith.exe instead of tirith. The original code only handled Linux/macOS archive and binary conventions, which caused auto-install to fail. This PR adds the Windows archive/install path and also fixes the follow-up resolution path so Hermes can keep finding the installed binary under $HERMES_HOME/bin after installation or on later runs.

Related Issue

Fixes the Windows WinError 2 auto-install failure for the Tirith security scanner.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• add Windows platform detection in tools/tirith_security.py (pc-windows-msvc)
• download .zip archives for Windows while keeping .tar.gz for Linux/macOS
• extract tirith.exe from Windows release archives and skip Unix-style chmod on Windows
• preserve support for nested archive members when resolving the extracted binary path
• add Windows-aware bundled binary lookup so Hermes can resolve $HERMES_HOME/bin/tirith.exe after install and after restart
• move coverage into tests/tools/test_tirith_security.py and remove the standalone ad-hoc test script

How to Test

1. Run python -m pytest tests/tools/test_tirith_security.py -q -n 0
2. On Windows, verify auto-install downloads the .zip release and installs tirith.exe
3. Verify Hermes can resolve the installed binary from $HERMES_HOME/bin/tirith.exe on a later run without reinstalling

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: Windows 11 (PowerShell 7)

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Screenshots / Logs

• python -m pytest tests/tools/test_tirith_security.py -q -n 0 -> 66 passed in 1.68s on Windows
• Manual verification: installed Windows release resolves as tirith.exe
• Linux/macOS install paths remain unchanged

[teknium1]

Thanks for this — appreciate the work. We're closing the entire cluster of open native-Windows PRs (44 of them spanning installer, terminal routing, file ops, gateway PID handling, encoding, docs, and more) because the surface area needs a designed, consolidated approach rather than piecemeal merges. Cherry-picking individual fixes keeps leaving inconsistencies and we'd rather land Windows support properly, in one coherent pass.\n\nYour PR is catalogued in our internal Windows support plan. When we pick this back up (soon), we'll mine every PR in the cluster for its fix shape and credit all contributors whose work informs the final patch via lines. Watch for the consolidating PR and feel free to chime in with context on the specific failure mode you were hitting.\n\nClosing for now, not as a rejection of the fix — just queueing it for the designed rollout. Thanks again.