Harden release matrix and Windows executable handling

[PerfectPan]

Summary

• Make installed OpenClaw test fixtures and staged install verification Windows-aware.
• Resolve active .bin commands before execution so ocvm exec -- openclaw can run Windows .cmd shims.
• Run the full release build matrix on pull requests and publish only for tag pushes.
• Replace retired macos-13 with macos-15-intel for the x86_64 macOS release asset.

Why

The first v0.1.0 tag exposed gaps that PR CI did not cover: Windows tests failed in the release job, and the Intel macOS runner label was retired. Release readiness now requires Linux, Intel macOS, Apple Silicon macOS, and Windows build/test/package jobs to pass before merge.

Failed release run: https://github.com/PerfectPan/ocvm/actions/runs/25311537082

Validation

• ./scripts/check-release-prep.sh
• cargo fmt --check
• git diff --check
• cargo clippy --all-targets -- -D warnings
• cargo test
• cargo build --release
• cargo package --allow-dirty --offline -> 29 files, 29.7KiB compressed
• GitHub Actions release matrix on this PR:
  • build x86_64-unknown-linux-gnu passed
  • build x86_64-apple-darwin passed
  • build aarch64-apple-darwin passed
  • build x86_64-pc-windows-msvc passed
• test passed
• npm openclaw install in Docker passed

Next after merge

Move/re-push v0.1.0 to the new main head to rerun the fixed release workflow and generate GitHub Release assets.