fix(windows): make install and uninstall recoverable

[PathGao]

Summary

Both flows could leave a machine in a state with no supported way out.

Uninstall removed the registry entries first. An unelevated uninstall of a Program Files install deleted the Add/Remove Programs key and the shortcuts, then spawned a batch script whose every del/rmdir was silenced with > nul 2>&1. The files stayed on disk, the app was gone from Add/Remove Programs, and handle.exit(0) ran regardless — uninstall_app always returned Ok(()), so the failure was never reported.

Now a deletability precheck runs before anything is touched, the script logs each step to a temp file instead of discarding the output, and it restores the uninstall entry if deletion fails. Registry cleanup happens last.

Install had no rollback. The executable was copied at step 2, but the Add/Remove Programs entry was not written until step 6. Any failure in between — most likely a shortcut in a locked-down Public Desktop — aborted the ? chain with the exe in place. is_installed() then reported true by path match, so the installer UI never appeared again, while nothing had ever been registered: uninstallable through Windows, unreachable through the app.

Elevation is now checked before the first mutation, and completed steps are undone in reverse on failure. An update/repair never deletes what it was updating.

Also in these paths

• restore_file_association opened keys with create_subkey, so uninstalling materialised HKLM\Software\Classes\.md and .markdown on machines where Markpad had never registered them, then deleted a default value that did not exist. It now opens read/write and returns early when the key is absent. The other hive is cleaned too, but only when no installation is registered there — otherwise an all-users uninstall breaks a coexisting per-user install and leaves .md pointing at a dead ProgID.
• wscript was launched by bare name, so the process search order checked the application and current directories before %PATH%. It is now resolved through %SystemRoot%\System32, as are taskkill, timeout and reg inside the batch. Temp script names carry random suffixes and use create_new rather than being fixed and overwritable.
• Permission failures return an ELEVATION_REQUIRED: code. The installer UI matched the literal string Access is denied, which only appears on English Windows — localized systems showed the raw exception instead of the "run as administrator" message.

Validation

• cargo test — 41/41 (Windows-only logic is extracted into pure functions gated cfg(any(target_os = "windows", test)), so ordering, rollback and script generation are exercised on any host)
• cargo clippy — no new warnings; the Windows branches were additionally type-checked against x86_64-pc-windows-msvc and come out one warning below the current baseline
• npm run check / npm test — clean, for the installer error-code change

Needs a pass on real Windows

The batch script text was reviewed by hand but never executed, and can_write_dir behaviour under UAC virtualization can only be observed on the real thing. Worth exercising before release: unelevated all-users install, a failure at the Public Desktop shortcut, update/repair failing midway, unelevated uninstall of a Program Files install, and .md association after an all-users uninstall with and without a coexisting per-user install.