Harden Windows per-machine installer uninstall smoke and release gates

[ken-jo]

Outcome

Make the Windows per-machine NSIS install / KEEP_APP_DATA / DELETE_APP_DATA validation truthful and fail-closed before the next signed desktop release.

Required scope

• unattended /allusers install and uninstall
• exact HKLM 32/64 uninstall registration checks
• positive ASRT user/group/credential/marker/WFP and ACL preconditions
• updater-vs-genuine-uninstall separation
• KEEP preservation and DELETE removal
• DELETE → guide the initiating standard user to reinstall → first launch as that user → verify recreated LVIS userData ownership
• verify a distinct administrator profile's LVIS paths remain unchanged
• signed-candidate manual UAC and migration evidence before release

Owner

@ken-jo

Evidence

Implementation branch: agent/19-installer-smoke
Exact reviewed candidate: e528c8ad62306a46944513cd520454a20831d8e1