docs: add step-by-step Windows installation

test/client-installer.test.ts

@@ -121,7 +121,9 @@ test("generic installer preserves identity across safe updates, rollback, downgr
   const installOutput = JSON.parse(output.pop()!);
   assert.equal(installOutput.restartRequired, undefined);
   assert.match(installOutput.nextSteps.join(" "), /当前 Agent.*skillPath.*stdio MCP/);
+  assert.match(installOutput.nextSteps.join(" "), /Windows.*\.cmd.*禁止把网关 URL 配成 MCP/s);
   assert.match(installOutput.nextSteps.join(" "), /立即处理 postInstall.*不得等待用户首次查询审批/s);
+  assert.match(installOutput.nextSteps.join(" "), /双来源只读验证.*钉钉 OA 与薪福通均为 ok/s);
   assert.equal(installOutput.postInstall.status, "authorization_required");
   assert.equal(installOutput.postInstall.authChallenge.directUrl, "https://approval.example.test/oauth/device?user_code=INSTALL-1234");
   assert.deepEqual(installOutput.loginCommand, {

test/distribution.test.ts

@@ -17,6 +17,14 @@ test("customer distribution is a generic single-login gateway bridge", () => {
   assert.match(installer, /读取返回的 `postInstall`.*不得等到用户第一次查询审批/s);
   assert.match(installer, /登录链接过期.*绝不能重新安装.*approval_login.*loginCommand/s);
   assert.match(installer, /onboarding\.firstRun=true.*简短示例.*不要自动执行/s);
+  assert.match(installer, /Windows（PowerShell）/);
+  assert.match(installer, /Invoke-WebRequest[\s\S]*Get-FileHash[\s\S]*ConvertFrom-Json/);
+  assert.match(installer, /dingtalk-approval-bridge\.cmd/);
+  assert.match(installer, /显示 302 或启动后立即退出[\s\S]*type: \"stdio\"[\s\S]*doctor --json/);
+  assert.match(installer, /sourceStatus[\s\S]*dingtalk\.status[\s\S]*xft\.status[\s\S]*都必须是 `ok`/);
+  assert.match(installer, /更新[\s\S]*update --json[\s\S]*卸载[\s\S]*uninstall --yes --json/);
+  assert.match(installer, /不能热加载[\s\S]*完整退出并重新启动 Agent/);
+  assert.doesNotMatch(installer, /npm install -g|npx\s/);
   assert.doesNotMatch(installer, /通过当前 Messenger/);
   assert.doesNotMatch(installer, /DWS_CLI_PATH|dingtalk-workspace-cli|APP_MODE=local/);