Fix: Windows: downloaded mkcert binary saved without .exe extension

[pullapprove5]

Reproduced the finding with a new unit test (plain-dev/tests/public/test_mkcert.py) that mocks platform.system() to "Windows" and drives MkcertManager.setup_mkcert() through its download path (stubbing the actual network download and CA-install subprocess calls to keep the test hermetic): before the fix, the resulting mkcert_bin path was the extensionless "mkcert", confirming the finding. Fixed plain-dev/plain/dev/mkcert.py by choosing "mkcert.exe" as the binary filename when platform.system() == "Windows" (else "mkcert"), mirroring the exact pattern already used in plain-tailwind/plain/tailwind/core.py and plain-code/plain/code/oxc.py for their own cached binaries. Re-ran the test after the fix and it passed. Ran the full plain-dev package test suite (146 tests, via cd plain-dev/tests && uv run --isolated --package plain-dev --with 'psycopg[binary]' python -m pytest, since scripts/test requires Docker/Postgres which isn't available in this sandbox) — all 146 passed, no regressions. Also ran ./scripts/fix plain-dev (ruff + oxlint/oxfmt + prettier) with no issues. Committed the fix and test as a single commit (9b2f03c2f6). Note: uv wasn't preinstalled in this sandbox, so I installed it via pip install --user uv to run the checks — this is a sandbox-environment detail with no effect on the change itself.

---

Opened by a PullApprove implementation run (implement-finding v4) for:

• PA-7 — Windows: downloaded mkcert binary saved without .exe extension

Merging this is what closes them as fixed.