fix: isolate and bound AppVeyor immutable release surfaces

[verioussmith]

Summary

• ignore enabled recovery records on normal AppVeyor tag builds
• pin controller recovery to immutable v0.9.187 / 01aae7ea9ab886627d49b68e7aed2349d9ceafc0
• normalize Tauri packaging to process-local lowercase CI=true
• split Windows work into six bounded jobs: binaries, tests, and Menubar for x64 + ARM64
• restrict binary compilation to focusa-cli, focusa-api, and focusa-tui
• run bounded focusa-license + focusa-core --lib tests in release profile
• convert the authenticated legacy updater signer in memory using pinned official libsodium 1.0.21-stable runtime SHA-256 b19069c44c3875a2d9b46123bee3200cdc26eb9514c296b13cf91e96f1175269
• clear signer/runtime bindings after packaging; never log or persist key bytes/passwords

Provider proof

• Build 227 / 54631430: combined surface hit AppVeyor’s exact 60-minute limit
• Build 229 / 54631970: x64/ARM64 binaries finished at 52/56 minutes, then tests hit 60 minutes; both Menubar jobs completed NSIS/MSI and failed legacy signer decoding
• authoritative detail: Issue AppVeyor Windows release jobs exceed the hosted 60-minute quota #488
• AppVeyor quota authority: https://www.appveyor.com/docs/build-configuration/#time-limitations

Verification

• git diff --check
• AppVeyor YAML parsed with Ruby/Psych
• bash -n tests/spec_release_matrix_static_test.sh
• 01a0587a-2ac0-7551-9fda-13c46d48d313 — six-surface release static gate, exit 0
• canonical pre-push format/version/parity/manifest/install-policy gates passed

Provider PowerShell and six-job runtime reproof remain required. The installed pre-release daemon omitted output_tail, so local results are not represented as formal docs/165 completion evidence.

Closes #480
Closes #488