test: fix rebrand-lag test failures; drop Windows installer

[s0ld13rr]

The OpenCode→PentestCode rebrand updated product code but left test fixtures asserting the old branding, so bun turbo test and the HttpApi exerciser were red on main. This brings the fixtures in line with the rebranded behavior — no product-code changes, only test fixtures + Windows installer removal.

Rebrand-lag test fixes (36 unit failures + HttpApi auth)

• provider plugins (vercel / openrouter / llmgateway / nvidia / kilo / zenmux / cerebras / cloudflare-*): expect pentestcode referer/title/source/integration/user-agent values instead of opencode.
• webfetch: user-agent pentestcode.
• observability: pentestcode.client / pentestcode.run resource attributes.
• config: fixtures write pentestcode.json/.jsonc and .pentestcode dirs (the loader no longer reads opencode.*).
• global / project: tmp dir pentestcode, project-id file .git/pentestcode.
• agent / session-runner(-recorded) / permission: default agent is pentest (renamed from build).
• location-layer: pentestcode.json fixture; drop apply_patch/edit/todowrite from expected tools (removed from core builtins in the fork).
• skill: built-in skill is customize-pentestcode.
• httpapi exerciser: send Basic auth user pentestcode to match the server's rebranded OPENCODE_SERVER_USERNAME default (was sending opencode → 401 on every protected route).

Legitimate opencode references were left intact: the opencode provider id, the opencode.ai/zen URL, app localStorage namespaces (opencode.global.dat) and DOM ids (#opencode-titlebar-right) — these are unchanged in product code, so e2e fixtures already match.

Windows installer removal

• Delete install.ps1 (the Windows curl entrypoint) and script/sign-windows.ps1; no build/CI references remained.
• Update the CLAUDE.md release checklist (no Windows targets / install.ps1).

Verified locally

• packages/core tests: 1075 pass, 0 fail.
• full bun turbo test: 8/8 tasks pass.
• check:generated: clean.
• test:httpapi coverage + auth: 208/208 pass.