Gate MSVC releases on extracted-package execution with a controlled Windows environment

Part of #611. Difficulty: **medium**. Audit baseline: master `3950416e` (2026-09-12).

## Current evidence

[.github/workflows/release.yml](https://github.com/wavefnd/Wave/blob/3950416efc55cbc5ae7d54535e5a4e8699394ff0/.github/workflows/release.yml#L925) runs package smoke on the same runner that installed MinGW/LLVM. The ARM64 smoke clears WAVE_WINDOWS_ARM64_LINKER but still inherits provisioning paths. These tests cannot establish independence from build-machine tools and libraries.

## Scope

Validate the actual x64 and ARM64 release archives in fresh jobs or equivalently controlled environments, isolated from checkout build outputs, compiler caches and MinGW paths. Test against the installation prerequisites chosen by the packaging task. If SDK installation is required, prove that the documented minimum setup is sufficient; do not claim a stock-Windows result from a Developer Prompt.

## Completion criteria

After extraction, run wavec -V, verify host/default target, compile and execute ordinary hosted std workloads, and exercise required bundled tools from paths containing spaces/non-ASCII characters. Audit PE imports and assert no MinGW payload/runtime dependency. Log actual tool paths, architecture and installed prerequisites. A missing required component or failing program blocks release and retains useful artifacts.

## Dependencies and boundaries

#621, #622, #625, #623; full ABI suites remain in their own issues.

Start in .github/workflows/release.yml around the package smoke jobs at line 925, and compare how x64 and ARM64 archives are tested after extraction. Run wavec -V, hosted std workloads, and bundled tools from paths with spaces/non-ASCII characters in controlled environments, then inspect PE imports and logs. Done means required prerequisites, paths, architecture, and failures are recorded and MinGW dependencies are absent.

Written by the indexing model from the issue text.