ci: install pinned WinGet validator

[HelloThisWorld]

Summary

• Install an exact Microsoft WinGet client before validating generated manifests on windows-2022.
• Run the WinGet workflow on relevant pull requests so validator bootstrap failures are caught before merge.

Related issues

None.

Detailed changes

• Pin Microsoft.WinGet.Client and the repaired WinGet client to version 1.29.280.
• Authenticate the official repair cmdlet's GitHub API requests with the workflow token.
• Verify winget.exe is executable before validation.
• Run winget validate with an explicit manifest path and disabled interactivity.
• Add a path-filtered pull_request trigger for the WinGet workflow.
• Extend the release Smoke gate to require the pinned validator and inspect immutable action references in both release workflows.
• Do not modify the existing v1.0.2 tag or Release assets.

Validation performed

• Reproduced WinGet workflow run 29688356573: public installer download, hash derivation, and manifest generation passed; validation failed only because winget was absent on windows-2022.
• Confirmed Microsoft documents Repair-WinGetPackageManager as the supported bootstrap/repair command and that it supports an exact -Version.
• Confirmed the official PowerShell Gallery publishes Microsoft.WinGet.Client version 1.29.280.
• powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File scripts/winterm/test.ps1 -Suite Smoke
  • Result: passed.
• git diff --check
  • Result: passed.
• The PR's path-filtered WinGet check will validate the actual Server 2022 bootstrap and generated manifests.

Checklist

• The change is focused and does not include unrelated formatting.
• Tests were added or updated where appropriate.
• All tests claimed above actually ran and passed.
• User-facing behavior and limitations are documented in this repository.
• Version or schema changes include compatibility and migration notes.
• Package identity, winterm.exe, and Microsoft Terminal coexistence remain isolated.
• No command text, terminal output, clipboard content, credentials, or private paths are logged.
• New source and script files contain the appropriate MIT license header.
• I did not include generated build output, secrets, certificates, or local absolute paths.