docs(windows): MOTW unblock note + reset script for fresh-install testing

Two small follow-ups from the v0.2.0-rc1 hands-on test that don't
change behavior but improve operator experience.

1. README.md - prepend the Windows install bullet with an Unblock
   step. Browser-downloaded zips are tagged Mark-of-the-Web (Zone.
   Identifier=3); Windows propagates that to every extracted file;
   SmartScreen then silently refuses to launch the unsigned
   InferNode.exe with NO dialog, no Event Log entry, nothing. The
   user-visible symptom is "double-clicked, nothing happened" -
   exactly what was hit during RC validation today. Right-click ->
   Properties -> Unblock BEFORE extracting clears MOTW on every
   file at extraction time and the launcher works normally.

   Code-signing with an Authenticode cert is the proper fix; tracked
   separately as a v0.3 follow-up.

2. tests/host/reset-windows-install.ps1 - one-shot script that
   reliably puts a Windows install back to first-run state:
     - kills running o.emu / InferNode / secstored processes
     - removes %USERPROFILE%\.infernode (overlay: secstore PAK,
       ndb/llm config, veltro markers, lucibridge.log, theme)
     - optionally removes %TEMP%\InferNode-dev (dev bundle)
     - optionally clears ANTHROPIC_API_KEY from user env
     - cleans the test/diagnostic log files we drop in %TEMP%

   Flags: -DeleteDevBundle, -ClearEnv, -Force. Default is the safe
   subset (just the overlay + processes); the more destructive
   options are opt-in. Useful for repeat fresh-install tests of
   future RCs without manual cleanup.

Refs: INFR-47