For those who don’t know, shift+F10 to bring up a command prompt when using a windows install image. Can do it when it starts asking you for stuff. I know the chkdsk tools and manage-bde (the bitlocker cli) are avaliable there at least.
I feel like you’d get this with the Protonmail Bridge. It acts as it a email provider on your local network, and handles the encryption stuff itself. I believe Thunderbird sees and stores the email it sees through that as plan text.