fix(security): complete Windows tirith install support

[XiaoXiao0221]

What does this PR do?

This PR fixes Windows auto-install support for the tirith_security tool.

On Windows, tirith releases use .zip archives and install tirith.exe instead of tirith. The original code only handled Linux/macOS archive and binary conventions, which caused auto-install to fail. This PR adds the Windows archive/install path and also fixes the follow-up resolution path so Hermes can keep finding the installed binary under $HERMES_HOME/bin after installation or on later runs.

Related Issue

Fixes the Windows WinError 2 auto-install failure for the Tirith security scanner.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• add Windows platform detection in tools/tirith_security.py (pc-windows-msvc)
• download .zip archives for Windows while keeping .tar.gz for Linux/macOS
• extract tirith.exe from Windows release archives and skip Unix-style chmod on Windows
• preserve support for nested archive members when resolving the extracted binary path
• add Windows-aware bundled binary lookup so Hermes can resolve $HERMES_HOME/bin/tirith.exe after install and after restart
• move coverage into tests/tools/test_tirith_security.py and remove the standalone ad-hoc test script

How to Test

1. Run python -m pytest tests/tools/test_tirith_security.py -q -n 0
2. On Windows, verify auto-install downloads the .zip release and installs tirith.exe
3. Verify Hermes can resolve the installed binary from $HERMES_HOME/bin/tirith.exe on a later run without reinstalling

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: Windows 11 (PowerShell 7)

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Screenshots / Logs

• python -m pytest tests/tools/test_tirith_security.py -q -n 0 -> 66 passed in 1.54s on Windows
• Manual verification: installed Windows release resolves as tirith.exe
• Linux/macOS install paths remain unchanged