ci(smoke): fail soft when the Windows Defender scan engine can't run

[DeusData]

Problem

The Windows Defender scan step in _smoke.yml treated any non-zero MpCmdRun exit as a malware detection ("BLOCKED: flagged binary!"; exit 1). But MpCmdRun -Scan returns 2 for a real detection and 0 for clean; any other non-zero means the scan engine could not run at all — e.g. hr=0x800106ba, the Defender antimalware service being unavailable on the runner, a chronic transient flake on GitHub's windows-arm64 runners.

This false-failed the v0.9.0 release on its first attempt (a re-run on a fresh runner passed). Worse, the "flagged binary!" wording mislabels a runner outage as malware.

Change

Distinguish the two: only exit 2 (an actual detection) hard-blocks; an engine failure emits ::warning:: and continues.

CI-change scope (per repo policy)

• Gating: reduces false-fails from a runner-side AV outage; a real detection (exit 2) still hard-blocks. Net: fewer flake-driven release failures, same real protection.
• Cost / trigger scope / matrix: unchanged — same scan runs on the same jobs.
• Flake surface: strictly reduced (this is the fix for that flake).