ci: probe OFX plugin discovery with a real fixture plugin; cd: restore Windows NSIS job

- new minimal C OFX plugin fixture (ci_test_plugin.c) compiled into a
  real .ofx.bundle by build_fixture.sh; the CI step points
  OFX_PLUGIN_PATH at it and asserts the scan_probe example discovers
  AND registers it (Linux/macOS)
- host bundle binary search now also covers the OFX-standard Win64
  platform directory
- cd.yml: restore the Windows NSIS packaging job (obsolete oakengine
  cdylib prebuild dropped) and repair the job indentation that had
  silently detached the macos/release jobs from the jobs: map;
  releases now gate on all three platforms

.github/workflows/ci.yml

@@ -176,3 +176,23 @@ jobs:
         if: runner.os == 'Windows'
         shell: msys2 {0}
         run: cargo test --workspace --locked
+
+      # ------------------------------------------------------------------
+      # OFX plugin discovery end-to-end
+      # ------------------------------------------------------------------
+      # Build a minimal but real OFX plugin into a .ofx.bundle, point
+      # OFX_PLUGIN_PATH at it and let the scan_probe example run the full
+      # host path (directory scan -> dlopen -> setHost -> load -> describe
+      # -> register). The assertion is the plugin's registration line; CI
+      # machines have no system-wide OFX plugins, so the fixture is the
+      # only discovery.
+      - name: Build OFX fixture plugin (Linux/macOS)
+        if: runner.os != 'Windows'
+        run: crates/oakplugin/tests/fixtures/build_fixture.sh .cache/ofx-fixture
+
+      - name: Probe OFX plugin discovery (Linux/macOS)
+        if: runner.os != 'Windows'
+        run: |
+          OFX_PLUGIN_PATH="$PWD/.cache/ofx-fixture" \
+            cargo run --locked -p oakplugin --example scan_probe > probe.log 2>&1
+          grep -q 'type_id=rs.oak.CiTestPlugin' probe.log