CI: Windows build + release on yuuka-windows

tool/package_windows.ps1 builds watch-together-<ver>-windows-x64.zip
(same layout as the Linux tarball, libmpv bundled, update.bat and
watch-together-server.exe). The release workflow gets a windows job;
ci runs the updater tests on Windows. Publishing moves to
tool/release_publish.dart (dart: only, no python/bash on Windows), which
tolerates both jobs racing to create the release and replaces an asset
on re-runs. release.sh writes both asset URLs into the manifest.
Windows jobs check out with plain git (the host's cached
actions/checkout clone was corrupt).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/ARCHITECTURE.md

@@ -547,7 +547,9 @@ with rollback on failure (writing the running executable fails with ETXTBSY;
 rename works). A packaged install is detected by `data/` and `lib/` next to
 the binary; anything else exits with "update manually". A manifest whose
 protocol is newer than the local one is a required update. Windows apply
-(`*.old` rename, swept on next start) exists but is untested. The version is
+renames in-use files to `*.old` (swept on next start); CI tests it against a
+running exe on NTFS. The manifest's `assets` maps `linux-x64` /
+`windows-x64` to archive URLs; top-level `url` (Linux) is for builds <= 0.2.1. The version is
 stamped with `--dart-define=APP_VERSION` (dev runs report `0.0.0-dev` and skip
 checks). `watch_together --upgrade` (or the shipped `update.sh`) runs it from
 the CLI; `UpdateController` runs the same code for Home's update indicator,