[AnthonyRonning]

The new Windows bootstrap correctly refuses ordinary startup before installation. The release builder nevertheless ran the unsigned, uninstalled executable with --build-info, so both master Dev and Prod builds failed after successful compilation and before signing (run 40463584325).

Use the existing bounded PE metadata reader for Windows build preflight, validating the requested profile and exact full source commit without executing the artifact. Mac/Linux keep their existing runtime CLI checks. Installed Windows startup admission and later signed installer/CLI smoke remain unchanged.

Validation:

• Focused metadata and shell regressions: 50 passed, one existing native Windows/Rust-only skip. The final three shell regressions passed again after expanding positive Mac/Linux coverage to both Dev and Prod.
• Actual build-release.sh runs against a non-executable PE fixture for MINGW/MSYS/CYGWIN and both profiles; rejects wrong profiles, source commits and dirty revisions; verifies Mac/Linux CLI execution and mismatched-profile refusal.
• Independent diff/trust review and selected repository hook passed.
• Root nix flake check --no-update-lock-file passed on aarch64-darwin, including release metadata and workflow checks.

Both original master failures are preserved. These portable checks do not establish a new native Windows build, signature, installation or updater qualification; those require the next actual master producer. Separate PR/source CI waiting remains waived for the release handoff.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}