feat(ci): run native Windows checks, off the pull-request path (#392)

Issue #368 asks for `cargo test`, `clippy` and `fmt` on the self-hosted
Windows runner. Doing that in ci.yml would have made the problem worse,
so this adds a separate workflow and moves the one job that was already
breaking the rule.

## Why a new file rather than a job in ci.yml

release.yml's header states the rule plainly: this repository is public,
self-hosted runners must not be reachable from a pull request, and
ci.yml is `pull_request`-triggered so self-hosted runners stay out of it.

The Windows service smoke test was the exception. It was gated on
`vars.ENABLE_WINDOWS_SERVICE_SMOKE`, which kept it skipped in practice,
but a repository variable is not a documented security boundary against
a fork pull request. GitHub's own documentation on variables says
nothing about fork availability either way, so enabling that gate would
have rested a public repository's self-hosted machine on an unverified
assumption. Moving the job removes the question instead of answering it.

Both triggers here are maintainer-only: `workflow_dispatch` needs write
access, and `push` fires only for commits already on main.

## windows-checks

Runs on every push to main, because coverage that has to be remembered
is coverage that lapses. `fmt`, `clippy --all-targets -- -D warnings`,
and `cargo test --lib`.

The three check steps carry `continue-on-error` and a final step that
fails the job on any of them. That is deliberate and temporary: #366
records four failing `--lib` tests and #367 four clippy sites, both
reported from a developer machine rather than from a run anyone else can
read, and a job that stopped at `fmt` would hide what the other two have
to say. Remove the flags once those close.

Two diagnostic steps run alongside. One records what the host actually
is, including its display adapters; the other runs `all-smi doctor` on
it. #370, #377 and #378 each need specific hardware, and that output is
how anyone decides whether this runner can settle them or whether they
stay open for want of a machine.

## windows-service

Moved unchanged. All six steps are byte-identical; only the header
comment and the gating differ. It now runs on request rather than on
every push, because it registers and deletes a real machine-wide service
and needs an elevated runner. Its first execution is what settles #357.

A concurrency group covers both jobs: one box, one persistent
CARGO_HOME, and a service registered under a fixed name.