fix: 引导脚本改为后台下载，不阻塞钩子；新增 download.ps1

- 旧版在钩子里同步 curl，大文件在慢链路上会被钩子超时杀掉，留下半截+锁
- 改为经 ShellExecute 启动隐藏 PowerShell 后台下载（脱离钩子进程），钩子毫秒级返回
- download.ps1 用 curl 下载、原子改名、清锁；纯 ASCII 避免 PowerShell 5.1 按 GBK 误读

scripts/notify.cmd

@@ -8,7 +8,7 @@ set "BIN=%~dp0..\bin"
 set "EXE=%BIN%\notify.exe"
 set "LOCK=%BIN%\notify.download.lock"
 
-rem only bootstrap on first run; the common path runs the exe directly (keeps piped stdin intact)
+rem first run: kick off a background download, do NOT block the hook
 if not exist "%EXE%" call :bootstrap
 
 if exist "%EXE%" "%EXE%" %*
@@ -17,29 +17,10 @@ exit /b
 
 :bootstrap
 if not exist "%BIN%" mkdir "%BIN%" 2>nul
-set "TMP=%BIN%\notify.exe.%RANDOM%.tmp"
-rem mkdir is atomic; success = this process downloads, failure = someone else is downloading
+rem mkdir is atomic; success = we start the download, failure = already downloading
 mkdir "%LOCK%" 2>nul
-if errorlevel 1 goto :waitdl
-rem double-check in case it just finished
+if errorlevel 1 exit /b
 if exist "%EXE%" ( rmdir "%LOCK%" 2>nul & exit /b )
-rem download to temp then atomic rename, so no half-written exe is ever seen
-curl -fsSL "%DOWNLOAD_URL%" -o "%TMP%"
-if errorlevel 1 ( del "%TMP%" 2>nul & rmdir "%LOCK%" 2>nul & exit /b )
-move /y "%TMP%" "%EXE%" >nul
-rmdir "%LOCK%" 2>nul
+rem launch a detached hidden PowerShell downloader (ShellExecute breaks away from the hook)
+powershell -NoProfile -WindowStyle Hidden -Command "Start-Process -WindowStyle Hidden -FilePath powershell -ArgumentList @('-NoProfile','-ExecutionPolicy','Bypass','-File','%~dp0download.ps1','-Url','%DOWNLOAD_URL%','-Out','%EXE%','-Lock','%LOCK%')"
 exit /b
-
-:waitdl
-rem did not get the lock; wait for the exe to appear (up to ~60s)
-set /a _w=0
-:waitloop
-if exist "%EXE%" exit /b
-if %_w% geq 120 (
-    rem timed out; a killed download may have left a stale lock, clear it for next time
-    rmdir "%LOCK%" 2>nul
-    exit /b
-)
-ping -n 2 127.0.0.1 >nul
-set /a _w+=1
-goto :waitloop