feat: hand the Windows office install to the user as a right-click .cmd

[quickbeard]

Summary

Closes out the silent-death investigation on Windows with a controlled field experiment (companion to the diagnosability work in quickbeard/codev-scripts#20):

• codevhub-spawned installer (node.exe → powershell.exe): killed mid-run by Kaspersky Endpoint Security — no exception, no WER crash record, no Defender log (KES active, Defender passive), deterministic kill point, occasionally the quarantined script vanishing from disk.
• The identical script from the identical folder (~/.codev-hub/office), launched by the user in an elevated shell: runs to "Verification passed - codev-office skills are ready".

So the trigger is process ancestry, not path or content — and endpoint policy is centrally managed and unchangeable in the affected environments. The affected user base is low-tech, so the fix optimizes for zero typing:

codevhub skill office on Windows no longer spawns the installer. It stages the script + bundle exactly as before, then:

1. writes Install-CoDev-Office.cmd (Uninstall-CoDev-Office.cmd for the hidden --uninstall flow) next to them, with any --skip-verify/--force-skills flags baked in;
2. opens the folder in Explorer (best-effort, Windows hosts only);
3. prints three steps: right-click the .cmd → Run as administrator → approve.

The .cmd reproduces the verified-good ancestry (explorer → cmd → powershell) and ends with pause, so the closing green "Verification passed" — or a [FAIL] from the scripts' new error traps — stays on screen. Ubuntu/macOS keep the fully automatic flow (KES isn't in play there), and --download-only/cross-platform staging also get the wrapper, which is handy for staging onto USB for another machine.

Test plan

• pnpm typecheck, pnpm check, full download/office suite: 33 passed
• New tests: windows staging writes the wrapper with flags baked in and never spawns; wrapper name/content cover the uninstall flow (CRLF, %~dp0, pause); the Windows-host test now asserts the handoff instead of the old spawn
• The explorer-open is crash-safe on spawn failure (async error event handled, not just try/catch)
• Field: run codevhub skill office on a KES machine → right-click flow → full "Verification passed" (matches the manual procedure already validated in the field today)

🤖 Generated with Claude Code

[quickbeard]

Added a second commit: the staged .cmd is now self-elevating — a plain double-click requests admin rights itself via a UAC prompt (Start-Process -Verb RunAs), covering environments where "Run as administrator" is stripped from the context menu. If elevation is declined or the user has no admin rights, it falls back to a non-elevated run, which the setup script explicitly supports (per-component UAC prompts; a declined one only skips that component, fatal for the .NET SDK alone). Printed instructions updated from right-click to double-click, with the no-admin path spelled out.