Feature: improve Windows tooling bootstrap and enable native semgrep via pipx

[DriesVenter]

Summary
Improve Windows contributor experience by enabling native semgrep install flow and improving installer behavior/documentation.

What this PR changes

• Updates semgrep guidance to support native Windows via pipx
• Adds helper flow for missing tool bootstrap on Windows
• Updates scan guidance to include pipx bootstrap hints

Why

• Current contributor flow on Windows is more complex than needed
• Native semgrep via pipx is useful and reduces setup friction
  Notes
• This is not a security remediation PR
• No upstream RCE issue is being claimed here
• CRLF findings were local checkout artifacts, not a repository-level line-ending defect