Fix Windows recovery finalization and packaged app startup

[amirbrooks]

Summary

• make Android archive, preserved-snapshot, and official-export recovery complete safely on Windows by deleting the private staging directory through its retained Win32 capability
• reuse existing Windows directory capabilities during analysis and no-clobber promotion instead of opening conflicting handles
• load WinUI control resources so the packaged app opens instead of crashing in Microsoft.UI.Xaml.dll with 0xc000027b
• harden the Windows artifact smoke test to require a real, responsive window that remains alive
• make NuGet license fixtures byte-stable and formatter-stable across Windows/Linux checkouts

Confirmed Windows dogfood

• reproduced the old downloadable artifact crash at commit 512d25a after verified install; Windows Application Error identified Microsoft.UI.Xaml.dll / 0xc000027b
• installed public CLI recovered synthetic Android compressed backup, preserved Android snapshot, and official export; independent output validation and privacy scrub passed
• final branch rebased onto current origin/main (7ffbcaf); final commit is 99cb876, with reviewed source tree fa8daaf
• downloaded the exact GitHub Actions artifact for 99cb876; outer ZIP SHA-256 and all eight manifest-bound internal file hashes/sizes passed
• verified the MSIX signature as Valid with the exact manifest certificate thumbprint
• installed the downloaded MSIX on a physical Windows machine; its TV Time Backup Extractor window had a real handle, remained alive, and was responsive after 8 seconds
• removed the test package and exact temporary certificate; zero package, certificate, or process residue remained

Test evidence

• final GitHub CI is green, including Windows existing-extraction/native filesystem tests on Python 3.10, 3.11, 3.12, and 3.13
• final source-bound Windows package workflow is green, including package install, stable responsive window, cleanup, ZIP reverification, and artifact upload
• local focused Windows/Android/security/release run: 176 passed, 4 intentional platform skips
• Release x64 WinUI build: 0 warnings, 0 errors
• Windows packaging identity/cleanup and MSIX capability/digest checks passed
• Ruff lint/format and Git diff checks passed

Environment limits

The physical test machine has BitLocker protection off, so native recovery correctly refuses real sensitive backup data under the project's safety policy. Synthetic CLI recovery and the exact downloadable packaged-app startup are confirmed. No physical Android device or emulator was attached, so device transport itself remains untested here.