docs(local): document the script-free Windows install path

What does this MR do and why?

The Windows install documentation offers only the PowerShell one-liner. On managed endpoints that restrict remote script execution, that path cannot run, and nothing tells the reader that the release archive is a single self-contained executable, signed by GitLab Inc., that installs by extract-and-place with no script execution and no administrator rights. This documents that path, with checksum verification. It is the slice of the no-script install need in #774 that is shippable today.

Related Issues

Relates to #774 (its problem statement is that script installs are hard to approve for cybersecurity teams; this documents the existing script-free path while package-manager distribution remains open).

Testing

markdownlint and Vale clean, and every link on the changed page resolves. (The repository's link check also reports six pre-existing broken references under .agents/, present on unmodified main and untouched here.) Claims verified against the published release artifacts: the Windows archive contains exactly one orbit.exe, and its Authenticode signature subject is GitLab Inc. (verified on v0.95.1).

Performance Analysis

Documentation-only change.

• This merge request does not introduce any performance regression. If a performance regression is expected, explain why.

Agent context — long-form analysis, file-by-file walkthroughs, profiler output, alternatives considered

Motivating scenario: a customer environment where endpoint policy restricts remote script execution (execution policy, Constrained Language Mode, or script-block restrictions), so irm ... | iex is not an option. Inspection of the release artifacts shows the documented installer is optional on Windows: orbit-local-windows-x86_64.zip holds a single self-contained orbit.exe, code signed (Extended Validation certificate issued to GitLab Inc.), and install.ps1 itself only downloads, checksum-verifies, extracts, and copies the binary into a user-scope directory. The manual steps in this change are the same sequence performed by hand.

Publisher-based allowlisting is called out because per-release hash rules are impractical at this project's release cadence; a signed publisher rule survives releases.

Placement: the new content stays inside the existing Windows tab in docs/source/local/getting-started.md rather than a new section or the access pages, to keep the install methods in one place. docs/source/local/access/cli.md currently has no Windows-specific content and was left untouched.

Related history: !1326 (merged) added install.ps1, !1325 (merged) added Windows code signing, !1355 (merged) added the platform install tabs. #595 proposes a different direction (the bash installer via Git Bash); this change neither depends on nor conflicts with it.

This MR travels with !2202 (merged), the fix for the silent no-success of orbit index on non-git paths (Relates to #1010): documenting an easier install path sends more first-run users into orbit index, so !2202 (merged) should land with or before this page change.

This MR was prepared with assistance from Claude Code; artifact claims were verified against the published release, and the page passes the repository's docs lint.