chore: release 1.5.1

[aksOps]

Patch release. Everything in it is the Windows work from #46:

• every previously published Windows binary panicked on any default-rules scan (CRLF checkout breaking the embedded rule pack); fixed by .gitattributes plus CRLF normalization in default_pack
• cache self-exclusion silently vanished on Windows when the cache directory sat under the scan root (verbatim vs 8.3 short-name spellings never sharing a prefix)
• silo and rule path glob syntax pinned to backslash-escape semantics on every platform instead of globset's Windows default
• Windows added to CI: full test suite plus a binary smoke test on a real Windows runner, both green for the first time

v1.5.1 is the first release whose Windows binary works.