feat: complete WorkBuddy parity and Windows release workflow

scripts/rea/recover-project-hero.cjs

@@ -0,0 +1,22 @@
+// Export only the image already retained by REA. No installation-directory access.
+const fs = require('node:fs')
+const path = require('node:path')
+const assert = require('node:assert/strict')
+const crypto = require('node:crypto')
+const evidence = JSON.parse(fs.readFileSync('.tmp/rea-todo20-project-hero.json', 'utf8').replace(/^\uFEFF/, ''))
+assert.equal(evidence.evidence_id, 'ev_d740e73903dd69444105e2509b238e5912f2c93d3adaa183b05ec7221512ef7a')
+const item = evidence.normalized_result.visuals.media_assets.items.find(item => item.selector === '.landing-hero')
+assert.ok(item?.artifact)
+assert.equal(item.artifact.mime_type, 'image/png')
+assert.ok(item.source.url.endsWith('/landing-hero-B6659kdy.png'))
+const bytes = Buffer.from(item.artifact.data_base64, 'base64')
+assert.equal(bytes.length, item.artifact.bytes)
+assert.equal(crypto.createHash('sha256').update(bytes).digest('hex'), item.artifact.sha256)
+assert.equal(bytes.subarray(0, 8).toString('hex'), '89504e470d0a1a0a')
+const destination = path.resolve('src/renderer/src/projects/assets/landing-hero.png')
+if (process.argv.includes('--check')) assert.deepEqual(fs.readFileSync(destination), bytes)
+else {
+  fs.mkdirSync(path.dirname(destination), { recursive: true })
+  fs.writeFileSync(destination, bytes)
+}
+console.log(`PASS project hero: ${bytes.length} bytes; SHA-256 ${item.artifact.sha256}`)