E2E: Windows CLI artifact restore reports false payload digest mismatch

## Summary

The trusted manual PR E2E workflow produces a content-addressed CLI tar on Linux, but the `windows-latest` WSL target rejects the unchanged tar at `Restore exact-commit CLI artifact` with:

```text
exact-commit CLI artifact payload digest mismatch
```

The live E2E test never starts. The later artifact-summary and Docker-auth cleanup errors are cascades.

## Evidence

- PR #10470, current head `a268f8d708dc64ba565dead3825c334af1bb3e5b`: https://github.com/NVIDIA/NemoClaw/actions/runs/33203438738
- Earlier independent reproduction at head `f834f3c0c2a9184e24b8f73de528ec8461aa81cd`: https://github.com/NVIDIA/NemoClaw/actions/runs/33198409835
- Current artifact: `nemoclaw-cli-a268f8d708dc64ba565dead3825c334af1bb3e5b-d9c1107fee8eb1ee7368ddd26952d77c718b3ee60839f97c6c91f947093d2eeb`
- The downloaded `manifest.json` declares payload SHA-256 `d9c1107fee8eb1ee7368ddd26952d77c718b3ee60839f97c6c91f947093d2eeb`.
- Rehashing the downloaded `nemoclaw-cli.tar` outside the Windows consumer produces the same SHA-256, so the producer artifact and manifest agree.

## Suspected boundary

This is isolated to the Windows consumer digest command in `.github/actions/restore-e2e-cli-artifact/action.yaml`. Verify whether Git for Windows `sha256sum` needs explicit binary mode, or replace the check with a platform-stable binary hash implementation. This is an inference from the evidence above, not yet confirmed.

## Acceptance criteria

- A Linux-produced exact-commit CLI artifact restores on `windows-latest` without a false digest mismatch.
- The WSL target reaches its live E2E phase.
- A workflow contract test covers the cross-platform digest boundary.

Start in .github/actions/restore-e2e-cli-artifact/action.yaml and inspect the Windows consumer digest command, comparing its behavior with the Linux-produced tar and manifest. Reproduce the restore on windows-latest with the WSL target, then add a workflow contract test for the cross-platform digest boundary. Done means the artifact restores without a false mismatch and the live E2E phase starts.

Written by the indexing model from the issue text.