feat: stage the Windows office install in %PUBLIC% and bake real-user paths

[quickbeard]

Summary

Companion to quickbeard/codev-scripts#22 — two profile-divergence fixes for the Windows install flow. Field report: when codevhub skill office runs in an elevated shell (or the UAC prompt is approved with a different admin account), %USERPROFILE% resolves to the admin's profile and users keep looking for files — and worse, get skills installed — under the wrong account.

1. Profile-independent staging. The Windows default download dir moves from ~/.codev-hub/office to %PUBLIC%\Downloads\codev-office — the same absolute path for every account (normal shell, elevated shell, any admin), world-writable, not OneDrive-synced, not targeted by Storage Sense. Already-downloaded files migrate from the old dot-folder via same-volume renames, so multi-GB bundles are never re-fetched. --dir still overrides; Ubuntu/macOS are unchanged.
2. Real-user path baking in the .cmd wrappers. The install and uninstall wrappers now pass -ModulesDir %PUBLIC%\codev-office\node_modules (account-independent) and — when staged on a Windows host — -SkillsRoot pinned to the real user's skills folder, which codevhub knows authoritatively because it runs unelevated as that user. Combined with codev-scripts#22 (Machine-scope NODE_PATH when elevated), a different-account elevation now installs skills and modules where the actual user needs them. Cross-platform staging bakes only the modules dir, since the staging host's homedir says nothing about the target machine's user. Arguments containing spaces are quoted in the generated .cmd.

Deployment order: publish the codev-scripts#22 setup/uninstall scripts before releasing this — the baked -ModulesDir/-SkillsRoot flags are unknown parameters to the older published scripts.

Test plan

• pnpm typecheck, pnpm check, download/office suite: 36 passed
• New tests: baked args (modules dir always, skills root only on a Windows host), wrapper space-quoting, legacy-dir migration (moves absent files, never clobbers, missing source is a no-op); cross-platform staging asserts no -SkillsRoot
• Field: fresh Windows machine, UAC approved with a different admin account → skills land in the real user's .config\codev\skills, node -e "require('pptxgenjs')" works as the real user, staging folder identical from both shells

🤖 Generated with Claude Code

[quickbeard]

Added a hardening commit for the "does %PUBLIC%\Downloads exist?" question: the folder is recreated automatically by the recursive mkdir if a debloat script pruned it, and when a hardened image denies non-admin writes under C:\Users\Public entirely, staging now falls back to the old per-user ~/.codev-hub/office with a printed notice instead of crashing (explicit --dir choices still fail loudly). Covered by a chmod-based test.