feat(packaging): signed Inno Setup installer for the Windows host + CI

MSIX (the client's format) can't install the host's LocalSystem secure-desktop
service or the SudoVDA kernel driver, so the host ships as a signed Inno Setup
setup.exe that runs elevated and delegates to the existing idempotent
`punktfunk-host service install`.

- packaging/windows/punktfunk-host.iss: lay exe into Program Files, optional
  SudoVDA driver task, run service install/start; [Code] stops+waits the service
  before file copy on upgrade; uninstall runs service uninstall.
- pack-host-installer.ps1: cert (reuses MSIX_CERT_PFX_B64 / self-signed CN=unom),
  sign inner exe + setup.exe, fetch/stage SudoVDA, run ISCC, export public .cer.
- fetch-sudovda.ps1 / install-sudovda.ps1: pinned SudoVDA + nefcon download, cert
  import, gated device-node create (no phantom dup), pnputil install (warn-not-abort).
- nvenc/: synthesize nvencodeapi.lib via llvm-dlltool from a 2-export .def so
  --features nvenc links with no GPU/SDK at build time.
- .gitea/workflows/windows-host.yml: build (nvenc) -> clippy -> ISCC -> sign ->
  publish setup.exe + .cer to the generic registry pkg punktfunk-host-windows.
  Tag host-win-v* -> X.Y.Z (+ latest/ alias); main push -> rolling 0.2.<run>.
- setup-windows-runner.ps1: provision Inno Setup; docs: installer instructions.

SudoVDA/nefcon release URLs+SHA-256s in fetch-sudovda.ps1 are placeholders
(baseline v0.2.1) — fetch warns + prints the computed hash until pinned.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/windows-service.md

@@ -4,7 +4,24 @@ The `PunktfunkHost` Windows service is the end-user way to run the host on Windo
 manual bring-up chain (a scheduled task → `PsExec64 -s -i 1` → `wscript launch.vbs` → `host-run.cmd`)
 with one command, auto-start on boot, and supervision.
 
-## Install
+## Install (installer — recommended)
+
+Download the signed installer from the package registry
+(`punktfunk-host-windows`, <https://git.unom.io/unom/-/packages>) and run it (it elevates itself):
+
+```
+punktfunk-host-setup-<ver>.exe              # wizard
+punktfunk-host-setup-<ver>.exe /VERYSILENT  # unattended
+```
+
+It lays the host into `C:\Program Files\punktfunk`, optionally installs the bundled **SudoVDA**
+virtual-display driver, then runs `service install` + `service start` for you. Upgrades stop the
+service first and re-point it; uninstall (Add/Remove Programs) runs `service uninstall`. Packaging
+details: [`packaging/windows/README.md`](../packaging/windows/README.md). A self-signed CI build also
+publishes a `.cer` — import it once (`Import-Certificate -FilePath punktfunk-host-windows.cer
+-CertStoreLocation Cert:\LocalMachine\TrustedPublisher`) so Windows trusts the signed setup.
+
+## Install (manual / CLI)
 
 From an **elevated** (Administrator) prompt: