Make mining a verified one-command path - #14

The guide told Windows users to open WSL2 or try the desktop app preview.
Neither is a working GPU path. Under WSL2 the miner's wgpu backend has no
reliable route to the host GPU, and the desktop app is a preview that does not
pin or verify what it downloads. Meanwhile the compatibility manifest already
carried Windows URLs and checksums for both binaries, and the chain's own
MINING.md documents the native MSVC node as supported.

Verified by hand on a Windows 11 laptop with an RTX 3070 before writing any
of this, using only the manifest's Windows assets:

  node v0.10.0     starts on Planck natively, no WSL, syncs at ~175 blocks/s,
                   writes miner-auth-token and miner-tls-cert-sha256
  miner v4.0.2     SHA-256 matches the manifest, benchmarks at 33.6 MH/s on
                   the discrete GPU, and against the node: authenticates,
                   registers, receives job 1, returns a Completed result
  key quantus      --scheme wormhole --words re-derives the same address and
                   inner hash from a phrase on stdin, so the hidden prompt works
  system_syncState exposes current and highest block over RPC on 9944

quantus-mining.ps1 is a twin of quantus-mining.sh, not a port of its text:
same commands (mine, setup, status, start, stop, restart, restart-check,
config, uninstall), same manifest fields, same fail-closed checks on network,
protocol, release URL, asset name and checksum, same pair probe on --help,
same hidden recovery-phrase prompt with the phrase passed on stdin only, same
owner-only files for the config and the reward preimage, same redaction in
status, same status contract. Where Windows differs it says so in a comment.

Two things the Windows status does that the shell one does not yet:

  - While syncing, it shows block, target, rate and time left, measured over a
    five second window from system_syncState. Full sync is the only mode this
    node supports (warp reports no provider, fast refuses on archive nodes),
    and it takes one to a few hours. Saying "Syncing" for two hours is the
    single worst part of the newcomer experience; a number that moves is not.
  - It detects the Windows Defender stall MINING.md warns about (peers
    connected, block number not moving) and prints the one-time elevated
    command as the single recovery action, instead of leaving the user to
    diagnose it. The exclusion itself is left to the user: it is a security
    setting, and the installer never elevates.

The guide gains a PowerShell download-and-verify block beside the curl one,
opens with "open a shell" instead of "open WSL2", and gets two Windows rows in
the recovery table. The skill routes native Windows to the .ps1 and no longer
sends anyone to the app preview. The shell installer's unsupported-OS message
now names the .ps1. quantus-mining.ps1.sha256 is published beside it, and the
shell installer's checksum is regenerated for its one changed line.

mining.conf.example still showed INNER_HASH inside the public config, which
the installers stopped doing in this branch; it now matches what they write.

Tests: seven new cases. Static ones check the command contract, the manifest
keys the script reads, that the phrase never reaches the command line or the
config, that the guide and skill point Windows at the .ps1, and that the
published checksum matches the bytes. Behaviour ones parse the script with
PowerShell's own parser and exercise manifest loading, protocol classification,
fail-closed checksums and redaction by dot-sourcing it; they run on pwsh or
Windows PowerShell and skip where neither exists, so a Linux runner without
pwsh still passes the static half. Parsed clean on both PowerShell 7.6 and
Windows PowerShell 5.1, which ships with Windows.

Not done here: a run of the installer's own download path on a clean Windows
machine, which needs the 23 MB node archive fetched through the script rather
than by hand. Everything downstream of that download is what was verified
above.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Publish a plain Markdown setup prompt and link it before manual prerequisites. Reuse the pinned compatibility manifest and verified installer flow; pause for private wallet input and distinguish syncing from mining.

Add endpoint/link/safety tests and allow 20 seconds for the existing five-process PowerShell test. Validation: typecheck, 23 passing tests, production build, published artifact hash and guide-link checks. No live mining validation performed.