Prove portable WebView ACL grants

[jamditis]

Before submitting

• I searched existing issues and pull requests (including closed ones) so this isn't a duplicate
• I tested this change locally

Skipping any of the above? Explain why here:

None.

Description

Use Microsoft's exact unquoted numeric-SID syntax for the fixed WebView2 runtime ACL grants. Add a Windows CI probe that compiles and runs both quoted and unquoted forms through the same pinned NSIS 3.11 toolchain as Tauri, compares them with a direct icacls control, and verifies explicit and inherited rules by numeric SID.

The probe showed that quoted, unquoted, and direct invocations produce identical ACLs. This confirms that the failed release check was a false negative from PowerShell's convenience .Access enumeration, not an NSIS serialization failure. The signed release verification now uses GetAccessRules with SecurityIdentifier output and logs raw icacls output, access-only SDDL, and numeric access rules before asserting permissions.

The NSIS archive is verified against Tauri CLI 2.10.0's pinned SHA-1 before use.

Related issues

Relates to #141.

Testing

• bun run lint
• bunx tsc --noEmit
• bun run test (285 passing)
• bunx prettier --check .github/workflows/ci.yml .github/workflows/release.yml scripts/portable-webview-workflow.test.ts
• bun run build
• git diff --check
• Windows NSIS ACL probe: quoted, unquoted, and direct variants produced matching explicit and inherited SID rules
• gpt-5.5 low review: no findings
• gpt-5.6-sol xhigh review: no findings

cargo fmt --check could not run locally because this runtime does not have Cargo installed. No Rust files changed, and required GitHub CI runs the repository formatting gate.

Screenshots / videos (optional)

Not applicable; this changes installer permissions and workflow verification only.