fix(runtime): stabilize Windows preparation and smoke checks

scripts/prepare-runtime-bundle.mjs

@@ -2,10 +2,23 @@
 import fs from 'node:fs/promises'
 import path from 'node:path'
 import { spawnSync } from 'node:child_process'
+import { setTimeout as delay } from 'node:timers/promises'
 import sevenZip from '7zip-bin'
 import { transformRuntime } from './runtime-transform.mjs'
 import { projectRoot, runtimeRoot, manifest, digest, inventory, verifyRuntimeBundle } from './runtime-bundle.mjs'
 const cache = path.join(projectRoot, '.tmp/runtime-downloads')
+async function renameExtractedDirectory(source, destination) {
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      await fs.rename(source, destination)
+      return
+    } catch (error) {
+      // Windows scanners can briefly hold freshly extracted executables open.
+      if (process.platform !== 'win32' || !['EPERM', 'EACCES', 'EBUSY'].includes(error.code) || attempt >= 9) throw error
+      await delay(100 * (attempt + 1))
+    }
+  }
+}
 await fs.mkdir(cache, { recursive: true })
 const stage = await fs.mkdtemp(path.join(runtimeRoot, '.prepare-'))
 try {
@@ -26,7 +39,7 @@ try {
     const result = spawnSync(sevenZip.path7za, ['x', archive, `-o${unpack}`, '-y'], { encoding: 'utf8', windowsHide: true })
     if (result.error || result.status !== 0) throw new Error(`Archive extraction failed: ${runtime.id}: ${result.error || result.stderr || result.stdout}`)
     const target = path.join(stage, runtime.id)
-    await fs.rename(path.join(unpack, runtime.prefix), target)
+    await renameExtractedDirectory(path.join(unpack, runtime.prefix), target)
     await transformRuntime(runtime.id, target)
     // No loose mutation of the extraction lock. A source update requires reviewed tree digest changes.
     const tree = digest(JSON.stringify(await inventory(target)))