Fix cross-version installer validation

[KanuTomer]

What changed

• make the installer lifecycle backward-compatible with the previous successful main build
• require a genuine SemVer upgrade with different SHA-256 bytes and recorded baseline provenance
• retain strict current-build launch hooks and add redacted lifecycle/uninstall diagnostics
• fix Delete All temporary-audio cleanup so its own maintenance reservation does not self-block
• tolerate only the expected disappearing-path ENOENT while NSIS removes the tree, while polling actual residual payload to the real deadline
• publish only the exact package-version installer plus SHA256SUMS.txt
• bump the technical preview to 0.2.0-beta.1 and document its limited testing boundary

Root causes

1. The new lifecycle harness launched the older 0.1.0 baseline with a result-file hook that did not exist in that build. The legacy app stayed tray-resident and the harness timed out before upgrade checks.
2. Run 29640718999 reached Delete All and exposed a deterministic self-lock: Delete All held the coordinator maintenance reservation while ordinary temporary-audio cleanup rejected that same reservation as busy. A maintenance-only cleanup path now preserves the normal active-operation guard.
3. Run 29641353891 then passed clean install/uninstall, legacy initialization, genuine upgrade, current launch, preservation, and all eight Delete All scopes. Final uninstall was misreported after about three seconds because recursive enumeration raced NSIS deleting a traversed directory. The scanner now treats only ENOENT as a vanished subtree, propagates other filesystem failures, and keeps the strict 60-second payload-removal gate.

Local validation

• npm audit: 0 vulnerabilities
• npm run verify: 284/284 Vitest, 29/29 .NET, production build green
• M4: 50/50
• M6 preflight: zero network, spending disabled
• M7: 50/50
• helper smoke: valid 16 kHz mono capture
• Playwright: 5/5
• focused lifecycle/checksum/deletion/TOCTOU regressions: green

A fresh local NSIS retry again stalled at the unsigned makensis stage under Windows Smart App Control. Security controls were not disabled or bypassed, and the incomplete installer was not accepted for packaged probes. This draft PR's clean Windows workflow is the authoritative packaging and full cross-version lifecycle gate.

Final delivery

• PR-head workflow 29642339429: green on 6820f96
• merged with merge commit dc1b609aa7ada595e14833d36c98a0806744c603
• post-merge main workflow 29642541009: green
• main lifecycle report: ok=true for clean-install and upgrade; installer SHA-256 0316d5fb996c930db1770ce1054fd2dcb89aedebc0e871d3ec0883ca5b9ea1ef
• main artifacts: PresenterAI-Windows-beta and PresenterAI-installer-diagnostics-29642541009
• main now strictly requires build-and-package

[KanuTomer]

Final delivery verified: post-merge main run 29642541009 passed the complete Windows gate and uploaded both the installer/validation bundle and redacted lifecycle report. main now strictly requires build-and-package. Installer SHA-256 recorded by the lifecycle report: 0316d5fb996c930db1770ce1054fd2dcb89aedebc0e871d3ec0883ca5b9ea1ef.