fix(windows): address code review security and reliability issues

- Add protection checks to Go analyze tool before delete operations
- Use try/finally to ensure Windows Update service restarts after cleanup
- Don't count interactive uninstall as automatic success
- Tighten orphaned app detection with stricter prefix matching

windows/lib/clean/apps.ps1

@@ -88,10 +88,23 @@ function Find-OrphanedAppData {
             # Skip if recently modified
             if ($folder.LastWriteTime -gt $cutoffDate) { continue }
             
-            # Check if app is installed
+            # Check if app is installed using stricter matching
+            # Require exact match or that folder name is a clear prefix/suffix of app name
             $isInstalled = $false
+            $folderLower = $folder.Name.ToLower()
             foreach ($name in $installedNames) {
-                if ($name -like "*$($folder.Name.ToLower())*" -or $folder.Name.ToLower() -like "*$name*") {
+                # Exact match
+                if ($name -eq $folderLower) {
+                    $isInstalled = $true
+                    break
+                }
+                # Folder is prefix of app name (e.g., "chrome" matches "chrome browser")
+                if ($name.StartsWith($folderLower) -and $folderLower.Length -ge 4) {
+                    $isInstalled = $true
+                    break
+                }
+                # App name is prefix of folder (e.g., "vscode" matches "vscode-data")
+                if ($folderLower.StartsWith($name) -and $name.Length -ge 4) {
                     $isInstalled = $true
                     break
                 }

windows/lib/clean/system.ps1

@@ -121,22 +121,25 @@ function Clear-WindowsUpdateFiles {
         }
     }
     
-    # Clean download cache
-    $wuDownloadPath = "$env:WINDIR\SoftwareDistribution\Download"
-    if (Test-Path $wuDownloadPath) {
-        Clear-DirectoryContents -Path $wuDownloadPath -Description "Windows Update download cache"
+    try {
+        # Clean download cache
+        $wuDownloadPath = "$env:WINDIR\SoftwareDistribution\Download"
+        if (Test-Path $wuDownloadPath) {
+            Clear-DirectoryContents -Path $wuDownloadPath -Description "Windows Update download cache"
+        }
+        
+        # Clean DataStore (old update history - be careful!)
+        # Only clean temp files, not the actual database
+        $wuDataStore = "$env:WINDIR\SoftwareDistribution\DataStore\Logs"
+        if (Test-Path $wuDataStore) {
+            Clear-DirectoryContents -Path $wuDataStore -Description "Windows Update logs"
+        }
     }
-    
-    # Clean DataStore (old update history - be careful!)
-    # Only clean temp files, not the actual database
-    $wuDataStore = "$env:WINDIR\SoftwareDistribution\DataStore\Logs"
-    if (Test-Path $wuDataStore) {
-        Clear-DirectoryContents -Path $wuDataStore -Description "Windows Update logs"
-    }
-    
-    # Restart service if it was running
-    if ($wasRunning) {
-        Start-Service -Name wuauserv -ErrorAction SilentlyContinue
+    finally {
+        # Always restart service if it was running, even if cleanup failed
+        if ($wasRunning) {
+            Start-Service -Name wuauserv -ErrorAction SilentlyContinue
+        }
     }
 }