fix(packaging/windows): pass installer source files as validated absolute defines

The {#SourcePath} relative-traversal for host.env.example/README kept tripping
ISCC ("path not found", error 2) regardless of the separator, so drop it: compute
the two paths absolutely in pack-host-installer.ps1, Test-Path them (clear PS error
if missing), and pass /DHostEnv + /DReadme. The .iss [Files] now reference the
absolute defines — no {#SourcePath}, no ..\.. traversal. Also prints "source ok"
for each so a future failure is unambiguous.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packaging/windows/pack-host-installer.ps1

@@ -109,8 +109,23 @@ function Sign-File([string]$Path) {
 # --- sign the inner exe before it's packed ----------------------------------------------------
 Sign-File $exe
 
+# --- resolve + validate the installer's source files (absolute paths -> ISCC /D defines) -------
+$repoRoot = (Resolve-Path (Join-Path $here '..\..')).Path
+$hostEnv = Join-Path $repoRoot 'scripts\windows\host.env.example'
+$readme = Join-Path $here 'README.md'
+foreach ($p in @($exe, $hostEnv, $readme)) {
+    if (-not (Test-Path -LiteralPath $p)) { throw "installer source file missing: $p" }
+    Write-Host "  source ok: $p"
+}
+$defines = @(
+    "/DMyAppVersion=$Version",
+    "/DBinDir=$TargetDir",
+    "/DOutputDir=$OutDir",
+    "/DHostEnv=$hostEnv",
+    "/DReadme=$readme"
+)
+
 # --- stage the SudoVDA driver bundle ----------------------------------------------------------
-$defines = @("/DMyAppVersion=$Version", "/DBinDir=$TargetDir", "/DOutputDir=$OutDir")
 if (-not $NoDriver) {
     $stage = Join-Path $OutDir 'stage'
     & (Join-Path $here 'stage-sudovda.ps1') -OutDir $stage