ci: submit stable releases to winget

[hazeliscoding]

Adds .github/workflows/winget.yml, the automated half of the roadmap's winget item in Getting found.

• It runs on release: released, so only stable releases go to winget. Betas and drafts never fire it.
• It calls Komac 2.16.0 directly. The archive is pinned by its SHA-256, which matches Komac's SHA256SUMS. I didn't use winget-releaser, because it pulls cargo-binstall@main and the newest Komac unpinned, inside a job that holds a token able to push to the fork.
• Until the WINGET_TOKEN secret exists, it skips with a notice. The secret is a classic token with public_repo.
• Komac can only update a package winget already has. The first version, hazeliscoding.Prompuff 1.1.0, goes in by hand.

This can't run end to end until 1.1.0 is in winget and the token is saved, so the roadmap item stays unticked.