Confirm the signed 2.2.0 agent runs on a clean Windows machine with Defender on #2230

docs/proposals/agent/03-opencode.md asks to confirm that the signed Windows build runs opencode on a clean machine with Defender on. 2.2.0's release CI ran the Azure-signed opencode.exe and rg.exe only on the GitHub runner. Open question 4 in docs/proposals/file-agent/04-runtime-and-packs.md (Smart App Control and the unsigned worker libraries) can be checked on the same machine.

Done when: on a clean Windows VM with Defender and Smart App Control in their default state, 2.2.0's SurfSense-Setup.exe installs, an Agentic chat makes a Word file, and the results are noted in 03 and 04.