fix: reject zero-byte Windows agent installs

[GioLealhmx]

Summary

• Reject zero-byte monk-agent.exe files in the Windows PowerShell bootstrap fast paths.
• Require a non-empty target before accepting a matching installed checksum sidecar.
• Verify the extracted Windows agent is non-empty before recording the installed checksum.
• Add a network-free Windows regression test for the zero-byte target + current sidecar case.

Root cause and impact

The PowerShell installer treated the archive checksum sidecar as sufficient proof that the installed Windows agent was current. If monk-agent.exe was truncated to zero bytes while monk-agent.sha256 still matched the current archive, the bootstrap exited successfully, printed the invalid target path, and never requested the replacement archive.

This leaves the Windows plugin path stuck on a broken managed executable until a checksum changes or the user manually deletes the files.

Scope

PR #84 addresses the shell implementation for #23. This PR is scoped to the separate PowerShell implementation reported in #115 and keeps the three public PowerShell script copies consistent.

Validation

• powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\ensure-monk-agent-windows-zero-byte.ps1 — pass
• powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests\block-monk-windows.ps1 — pass
• git diff --check — pass

Fixes #115

Prepared with Codex assistance and validated locally on Windows.