feat(packaging): signed Inno Setup installer for the Windows host + CI

MSIX (the client's format) can't install the host's LocalSystem secure-desktop
service or the SudoVDA kernel driver, so the host ships as a signed Inno Setup
setup.exe that runs elevated and delegates to the existing idempotent
`punktfunk-host service install`.

- packaging/windows/punktfunk-host.iss: lay exe into Program Files, optional
  SudoVDA driver task, run service install/start; [Code] stops+waits the service
  before file copy on upgrade; uninstall runs service uninstall.
- pack-host-installer.ps1: cert (reuses MSIX_CERT_PFX_B64 / self-signed CN=unom),
  sign inner exe + setup.exe, fetch/stage SudoVDA, run ISCC, export public .cer.
- fetch-sudovda.ps1 / install-sudovda.ps1: pinned SudoVDA + nefcon download, cert
  import, gated device-node create (no phantom dup), pnputil install (warn-not-abort).
- nvenc/: synthesize nvencodeapi.lib via llvm-dlltool from a 2-export .def so
  --features nvenc links with no GPU/SDK at build time.
- .gitea/workflows/windows-host.yml: build (nvenc) -> clippy -> ISCC -> sign ->
  publish setup.exe + .cer to the generic registry pkg punktfunk-host-windows.
  Tag host-win-v* -> X.Y.Z (+ latest/ alias); main push -> rolling 0.2.<run>.
- setup-windows-runner.ps1: provision Inno Setup; docs: installer instructions.

SudoVDA/nefcon release URLs+SHA-256s in fetch-sudovda.ps1 are placeholders
(baseline v0.2.1) — fetch warns + prints the computed hash until pinned.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packaging/windows/nvenc/gen-nvenc-importlib.ps1

@@ -0,0 +1,57 @@
+<#
+.SYNOPSIS
+  Generate the NVENC import library (nvencodeapi.lib) into -OutDir, so the host links with
+  `--features nvenc` on a box that has no NVIDIA Video Codec SDK and no GPU.
+
+.DESCRIPTION
+  The host links against nvencodeapi.lib (crates/punktfunk-host/build.rs). That import lib is just
+  a link-time stub for two exports of nvEncodeAPI64.dll (the real DLL ships with the NVIDIA driver
+  and resolves at runtime). We synthesise it from nvenc.def:
+
+    1. llvm-dlltool  — preferred; LLVM is on the CI runner PATH (C:\Program Files\LLVM\bin) and this
+                       works without a Visual Studio developer shell.
+    2. MSVC lib.exe  — fallback; located via vswhere (no vcvars needed).
+
+  Point PUNKTFUNK_NVENC_LIB_DIR at -OutDir before `cargo build --features nvenc`.
+
+.EXAMPLE
+  pwsh -File gen-nvenc-importlib.ps1 -OutDir C:\t\nvenc
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory = $true)][string]$OutDir,
+    [string]$DefPath = (Join-Path $PSScriptRoot 'nvenc.def')
+)
+$ErrorActionPreference = 'Stop'
+$ProgressPreference = 'SilentlyContinue'
+$PSNativeCommandUseErrorActionPreference = $false   # check $LASTEXITCODE ourselves (pwsh 7.4 safe)
+
+if (-not (Test-Path $DefPath)) { throw "module-definition file not found: $DefPath" }
+New-Item -ItemType Directory -Force -Path $OutDir | Out-Null
+$out = Join-Path $OutDir 'nvencodeapi.lib'
+
+# 1) llvm-dlltool (preferred) ------------------------------------------------------------------
+$dlltool = Get-Command llvm-dlltool -ErrorAction SilentlyContinue
+if ($dlltool) {
+    Write-Host "==> llvm-dlltool -> $out"
+    & $dlltool.Source -m i386:x86-64 -d $DefPath -D nvEncodeAPI64.dll -l $out
+    if ($LASTEXITCODE -ne 0) { throw "llvm-dlltool failed ($LASTEXITCODE)" }
+    Write-Host "    ok ($((Get-Item $out).Length) bytes)"
+    return
+}
+
+# 2) MSVC lib.exe via vswhere (fallback) -------------------------------------------------------
+$vswhere = Join-Path ${env:ProgramFiles(x86)} 'Microsoft Visual Studio\Installer\vswhere.exe'
+if (Test-Path $vswhere) {
+    $lib = & $vswhere -latest -prerelease -products * -find 'VC\Tools\MSVC\**\bin\Hostx64\x64\lib.exe' |
+        Select-Object -First 1
+    if ($lib -and (Test-Path $lib)) {
+        Write-Host "==> lib.exe -> $out"
+        & $lib "/def:$DefPath" /machine:x64 "/out:$out"
+        if ($LASTEXITCODE -ne 0) { throw "lib.exe failed ($LASTEXITCODE)" }
+        Write-Host "    ok ($((Get-Item $out).Length) bytes)"
+        return
+    }
+}
+
+throw "neither llvm-dlltool (LLVM bin on PATH) nor MSVC lib.exe (via vswhere) was found to build $out"

packaging/windows/nvenc/nvenc.def

@@ -0,0 +1,14 @@
+; Module-definition file for the NVENC import library the host links against with `--features nvenc`.
+;
+; The real entry points live in nvEncodeAPI64.dll, which ships with the NVIDIA driver. At LINK time
+; the host only needs an import library exporting these two symbols (see crates/punktfunk-host/build.rs:
+; it emits `cargo:rustc-link-lib=dylib=nvencodeapi` and searches PUNKTFUNK_NVENC_LIB_DIR). No GPU,
+; driver, or NVIDIA Video Codec SDK is required to BUILD — only to run, where the DLL resolves from
+; the installed driver. Generate nvencodeapi.lib from this file with gen-nvenc-importlib.ps1.
+;
+; The LIBRARY line names the DLL the import records point at — required for MSVC `lib.exe /def`
+; (without it the import name would default to "nvenc.dll"). llvm-dlltool takes the name from `-D`.
+LIBRARY nvEncodeAPI64.dll
+EXPORTS
+    NvEncodeAPICreateInstance
+    NvEncodeAPIGetMaxSupportedVersion