fix(install): 双击入口的密钥生成路径是坏的 —— 改为交给 install.ps1 处理

**Windows CI 的双击链路冒烟抓到的真 bug**（第四轮 CI 暴露）：
install.cmd 在「没有 PSK.txt」时自己用 cmd 生成密钥：
  for /f ... in ('powershell ... -Command "... ($b ^| ForEach-Object ...) ..."')
经 cmd 的 for /f 投递时需要 ^| 转义管道，而 ^ 未被消费、原样漏进 PowerShell →
  Unexpected token '^' in expression or statement
**必炸**：PSK.txt 已不在分发 zip 里（045e3b0），所以「首次双击安装」恰好走到这条路径。

修复：cmd 不再自己生成密钥 —— install.ps1 本来就有完整逻辑
（先复用既有 agent.json 的 key，没有再现场生成，且 PowerShell 引号安全）。
install.cmd 按有无 PSK 决定是否传 -Key。

顺带：本文件的 CRLF 曾被工具写坏，已恢复并复核（ASCII 0 非 ASCII、107 CRLF、无裸 LF）；
编码守卫单测 22 项通过，全量 195 单测 / 29 e2e 绿。

scripts/install.cmd

@@ -67,23 +67,16 @@ if exist "%PSKFILE%" (
     "if (Test-Path -LiteralPath '%PSKFILE%') { (Get-Content -LiteralPath '%PSKFILE%' -Raw).Trim() }"') do set "PSK=%%K"
 )
 
-if not defined PSK (
-  echo [*] No usable PSK.txt found - generating a new pre-shared key...
-  REM 32 random bytes via .NET, hex-encoded to 64 chars.
-  for /f "delims=" %%K in ('powershell -NoProfile -ExecutionPolicy Bypass -Command ^
-    "$b=New-Object byte[] 32; [System.Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($b); ($b ^| ForEach-Object { $_.ToString('x2') }) -join ''"') do set "PSK=%%K"
-
-  if not defined PSK (
-    echo [x] Failed to generate a key. Aborting.
-    if not defined CI pause
-    exit /b 1
-  )
-  REM Plain hex, no BOM: the file is read with `set /p` / Get-Content, and a
-  REM leading U+FEFF would corrupt the first byte of the key.
-  >"%PSKFILE%" echo %PSK%
-  echo [+] New key written to "%PSKFILE%"
-) else (
+if defined PSK (
   echo [+] Using key from PSK.txt
+) else (
+  REM No PSK.txt -> let install.ps1 handle it: it reuses the key from an existing
+  REM agent.json when present, otherwise generates one (in PowerShell, where quoting
+  REM is safe). Do NOT generate here in cmd: routing a PS one-liner with pipes through
+  REM `for /f` requires ^| escaping that leaks into PowerShell and breaks the parse
+  REM (real machine 2026-10-07: "Unexpected token '^'" - that is exactly the
+  REM first-run path, since PSK.txt is no longer shipped in the zip).
+  echo [*] No usable PSK.txt found - install.ps1 will reuse or generate the key
 )
 
 REM --- 3) install -------------------------------------------------------------
@@ -91,7 +84,11 @@ echo.
 echo [*] Installing nodeagent ^(node: %COMPUTERNAME%, port %PORT%, input control ON^)...
 echo.
 
-powershell -NoProfile -ExecutionPolicy Bypass -File "%PS1%" -NodeId "%COMPUTERNAME%" -Key "%PSK%" -AllowInput -Port %PORT%
+if defined PSK (
+  powershell -NoProfile -ExecutionPolicy Bypass -File "%PS1%" -NodeId "%COMPUTERNAME%" -Key "%PSK%" -AllowInput -Port %PORT%
+) else (
+  powershell -NoProfile -ExecutionPolicy Bypass -File "%PS1%" -NodeId "%COMPUTERNAME%" -AllowInput -Port %PORT%
+)
 set "RC=%ERRORLEVEL%"
 
 echo.