Add WinGet publish step

[adamtheturtle]

Summary\n- add WinGet release publishing step\n- document winget install option in README and docs\n- update dev lockfile updates from hooks\n\n## Testing\n- pre-commit hooks

---

Note

Medium Risk
Adds a new post-release publishing path (WinGet) and adjusts GitHub Actions permissions, which can affect the release pipeline and token/permission behavior if misconfigured.

Overview
Adds a new publish-to-winget job to the Release GitHub Action to publish the Windows .exe installers to WinGet via vedantmgoyal9/winget-releaser@v2, plus sets default workflow contents: read permissions.

Documents the new Windows install path in README.rst and docs/source/install.rst, and notes it in CHANGELOG.rst.

Updates uv.lock (dev tooling bumps including doccmd plus new dulwich, and minor updates to pyrefly, sybil-extras, and ty).

^{Written by Cursor Bugbot for commit 451f573. This will update automatically on new commits. Configure here.}

[adamtheturtle]

There should be two CLIs to install