fix: bound Windows agent download stalls

[paulcakeface]

Fixes #375.

The Windows PowerShell bootstrap currently uses unbounded Invoke-WebRequest file downloads. A server/proxy can accept the request (or send response headers and a few archive bytes) and then stop making progress, leaving the blocking SessionStart installer waiting indefinitely.

This change:

• adds configurable MONK_AGENT_DOWNLOAD_CONNECT_TIMEOUT (default 10s) and MONK_AGENT_DOWNLOAD_STALL_TIMEOUT (default 30s);
• validates both values as positive integer seconds;
• uses a Windows PowerShell 5.1-compatible HttpWebRequest streaming helper with separate request and read/write deadlines, so a slow-but-progressing archive is not subject to a short absolute transfer cap;
• preserves the existing raw-download behaviour that avoids the Windows PowerShell IE parser dependency;
• applies the change identically to all three distributed PowerShell installer copies;
• adds deterministic regression coverage for both a response-header stall and an archive that sends three bytes then stops;
• runs that regression in the existing Windows install E2E job.

Validation performed before opening:

• regression fails against untouched v0.1.58 by exceeding its configured deadline;
• regression passes on this branch: header_stall=bounded body_stall=bounded copies=3;
• invalid zero timeout exits 2;
• all changed PowerShell files parse cleanly;
• three installer copies are byte-identical;
• complete local checksum/archive install control passes;
• isolated smoke test against the real current stable get.monk.io Windows artifact completed successfully in ~9s.

This is the independent Windows PowerShell counterpart to #360 / #361, which only changes the POSIX shell installer.

[paulcakeface]

Bounty-deadline review nudge: the Windows download-stall fix is current against main; deterministic header/mid-archive stall regressions and the real stable-download smoke test are green. Happy to adjust quickly if you want anything changed before the 31 Aug cutoff.