fix(windows): document MotW unblock, surface config errors, fix taskkill quoting

[ShauryaaSharma]

Fixes #697

What does this PR do?

Addresses all three root causes reported in #697, where install.ps1 reports success but leaves the MCP server unconfigured on Windows.

1. Mark-of-the-Web (README)
Invoke-WebRequest stamps downloaded files with a Zone Identifier that causes PowerShell to refuse execution. The README Windows install steps now include an explicit Unblock-File .\install.ps1 step (both the quick-install
block and the manual-install block), with a note on -ExecutionPolicy Bypass as a fallback.

2. Swallowed config errors (install.ps1)
The try/catch around & $Dest install -y does not catch non-terminating exits. A non-zero exit code was silently swallowed and the script printed "Done!" regardless. The block now checks $LASTEXITCODE after the call and, if non-zero, prints a red error message and exits 1 so the failure is visible.

3. taskkill /FI quoting (compat_fs.c)
cbm_exec_no_shell on Windows used _spawnvp, whose MinGW CRT implementation does not quote arguments that contain spaces when building the CreateProcess command line. The filter value "IMAGENAME eq codebase-memory-mcp.exe" was passed as three bare tokens, causing taskkill to print ERROR: Invalid argument/option - 'eq' on every invocation.

cbm_exec_no_shell now uses CreateProcess directly with a new cbm_build_cmdline helper that produces a properly-quoted command line following the MSVC/Windows CRT convention (arguments with spaces, tabs, or embedded double-quotes are wrapped in "…", with backslashes before a closing quote doubled). The POSIX path (fork/execvp) is unchanged.

CreateProcess replaces _spawnvp at the same call site with the same security surface, no new subprocess capability is introduced, and no update to scripts/security-allowlist.txt is required.

Checklist

• Every commit is signed off (git commit -s) — required, CI rejects unsigned commits (DCO, see CONTRIBUTING.md)
• Tests pass locally (make -f Makefile.cbm test), full suite requires ASan + 64-bit toolchain unavailable in this environment; the cbm_build_cmdline quoting logic and cbm_exec_no_shell live-exec paths were verified with a targeted harness compiled under MinGW GCC 6.3 (7 quoting cases + 3 live CreateProcess exec cases, all passing)
• Lint passes (make -f Makefile.cbm lint-ci) — clang-tidy unavailable in this environment; please run in CI
• New behavior is covered by a test (reproduce-first for bug fixes) no test added to tests/; the fix is in the installer script and a Windows-only code path not currently covered by the test suite.

[DeusData]

Huge thanks for opening this PR and for the work you put into it.

The maintainer shop is currently full, so this may sit for a bit before it gets a proper review. We will come back to this as soon as possible with real feedback; I wanted to make sure it did not sit unacknowledged in the meantime.

[DeusData]

Thanks for the clear Windows fix. Before this can move forward, could you add a regression guard for the Windows quoting/config failure, or explain why it cannot live in the suite? This touches install.ps1 and Windows process spawning, so we’ll also need CI/maintainer verification around those paths.