As a Windows operator I can install fallout-agent via winget

## Story

As a Windows operator managing a CD target host, I want to install the Fallout deployment agent with a single `winget install Fallout.Agent` so I get a registered, ready-to-enrol Windows Service without manually unpacking a zip or scripting service registration.

## Why

RFC #113 defines `fallout-agent` as a self-contained executable that operators run on hosts the forge runner can't reach. For Windows fleets, "self-contained executable" is necessary but not sufficient — operators expect a native, signed, package-managed install with a Service entry that survives reboots. `winget` is Microsoft's default answer and the lowest-friction install path for the target audience.

## Acceptance criteria

Sub-tasks (filled in after creation):

- [ ] #124 — Author winget manifest YAML
- [ ] #125 — Build signed MSIX installer in release pipeline
- [ ] #126 — Installer registers FalloutAgent Windows Service
- [ ] #127 — Open automated PR to `microsoft/winget-pkgs` on stable tag
- [ ] #128 — Windows smoke test for winget install

## Out of scope

- MSIX Store distribution (separate channel; revisit if there's demand).
- ARM64 Windows builds (deferred until x64 is shipping cleanly).
- In-app auto-update — `winget upgrade` handles upgrade; agent owns no self-update logic in this story.

## Related

- RFC #113 — CD deployment agent/runner
- RFC #106 — Continuous Delivery vision