build: enable MSVC exception unwinding

[mark-e-deyoung]

Closes #294.

Stacked on #293 so the complete suite can run with isolated credential storage.

What changed

Adds MSVC /EHsc explicitly alongside the existing /WX policy.

Root cause

Fresh Visual Studio CMake configurations in the current toolchain generated empty CMAKE_CXX_FLAGS. Cached local builds retained /EHsc, masking the problem. Without unwind semantics, standard-library exception handlers emit C4530, and /WX correctly turns that warning into a hard failure.

Why this fix

/EHsc is MSVC's standard C++ exception model for code that uses standard-library exceptions. Suppressing C4530 or disabling warnings-as-errors would hide a real compiler-contract mismatch.

Validation

• brand-new CMake build directory with no caller-supplied CMAKE_CXX_FLAGS
• complete MSVC Release build, all production and test targets
• full CTest: 3/3 passed
• build remained warning-clean under /W3 /WX
• diff is one target-wide compiler option

Formal-method assessment

No formal-model update is appropriate: the compiler exception ABI is a build invariant, not a runtime state-machine transition. The relevant control is a clean-cache build gate; formal trace replay runs in test_core and passed.