feat: add Windows binary to release pipeline and self-updater

[jkbennitt]

Summary

• Add windows/amd64 to the release workflow build matrix and goreleaser config
• Windows releases use .zip format (vs .tar.gz for macOS/Linux)
• Update self-updater to detect platform and extract from the correct archive format (extractBinaryFromZip for Windows, extractBinaryFromTarGz for others)
• Release checksums now cover both .tar.gz and .zip assets

Context

The dashboard "Click to update" button returned no release asset found for windows/amd64 because no Windows binary was included in GitHub Releases. This PR adds Windows to the release pipeline so the self-updater works end-to-end.

Test plan

• go test ./... — all 19 packages pass
• go vet ./... — clean
• make build — compiles on Windows
• Verified update-check API returns correct response on Windows
• Verified dashboard update button no longer errors (tested via Playwright)

🤖 Generated with Claude Code

[jkbennitt]

@CalebisGross — this adds Windows to the release pipeline so the dashboard self-update button works on Windows. The updater now handles .zip extraction. Ready for review.

[CalebisGross]

Nice work — clean PR, well-scoped. Two things to address:

1. Add test coverage for extractBinaryFromZip

TestExtractBinary and TestExtractBinaryNotFound only exercise the tar.gz path. The new zip extraction has no tests. Should be straightforward — mirror the existing tests but build a zip archive instead.

2. Checksum glob is fragile

run: sha256sum *.tar.gz *.zip > checksums.txt

If either glob matches nothing (e.g. a matrix entry is skipped or fails), sha256sum gets a literal *.zip as an argument and errors out, which breaks the release job. Quick fix:

run: |
  shopt -s nullglob
  sha256sum *.tar.gz *.zip > checksums.txt

Everything else looks good — archiveExt() helper, the shell: bash additions, zip bomb limit carried over, goreleaser ignoring windows/arm64.

[CalebisGross]

Both items addressed, looks good. Thanks Jason!