feat(windows-ci): self-provisioning toolchain for the shared unom/infra runner

The Windows CI runner (home-windows-runner-1, vmid 210) is now provisioned/owned by
unom/infra and can be rebuilt or joined by additional windows-amd64-labeled runners at
any time - a manually-dispatched provisioning workflow has no way to target a specific
runner instance, so it could land on an already-provisioned box instead of the one that
needed it. Replace windows-drivers-provision.yml / windows-punktfunk-provision.yml with
scripts/ci/ensure-windows-toolchain.ps1, a shared idempotent pre-flight (WDK/cargo-wdk,
FFmpeg, Inno Setup, ARM64 rustup target) that every Windows workflow now runs at job
start - a fast no-op once already provisioned, so any runner self-heals on first real use.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

design/windows-build-and-packaging.md

@@ -178,16 +178,21 @@ forest. (`build-web.ps1` is the dev-box rebuild-and-restart helper.)
 
 ## 8. CI workflows (`.gitea/workflows/`)
 
-All run on the single self-hosted `windows-amd64` runner (`home-windows-1`), which **serializes** the
-whole Windows fleet - a `Cargo.lock`/`packaging/windows/**` touch queues several builds back-to-back.
+All run on a self-hosted `windows-amd64` runner (provisioned by unom/infra's `windows-runner/`
+Packer template + Terraform clone, `home-windows-runner-1`), which **serializes** the whole
+Windows fleet - a `Cargo.lock`/`packaging/windows/**` touch queues several builds back-to-back.
 
 | Workflow | Trigger | Does |
 |----------|---------|------|
 | `windows-host.yml` | `crates/punktfunk-host`, `packaging/windows`, `scripts/windows`, `web`, tags `v*` | build host + clippy + HDR layer + web smoke-boot -> pack + sign installer -> publish (canary/latest) |
 | `windows-drivers.yml` | `packaging/windows/drivers`, `crates/pf-driver-proto` | probe the driver toolchain + build/test/clippy `pf-driver-proto` + `cargo build` the driver workspace + inspect FORCE_INTEGRITY (the fast driver-only gate; coverage the pack lacks) |
-| `windows-drivers-provision.yml` | `provision-windows-wdk.ps1` | one-shot WDK + cargo-wdk provisioning onto the persistent runner |
 | `windows.yml` / `windows-msix.yml` | client | build the Windows *client* + its signed MSIX (x64 + ARM64) |
 
+Every workflow above self-provisions its own toolchain at job start via `scripts/ci/
+ensure-windows-toolchain.ps1` (WDK/cargo-wdk, FFmpeg, Inno Setup, the ARM64 rustup target) - a
+fast no-op once already present, so no separate one-shot provisioning workflow/dispatch step is
+needed, and it works the same on any runner sharing the `windows-amd64` label.
+
 `windows-host.yml` also builds the drivers from source (in pack), so it overlaps `windows-drivers.yml` on
 a `drivers/**` edit (two driver builds on the serialized runner). They're kept separate on purpose -
 `windows-drivers.yml` is the fast pre-pack gate. **CI builds, never launches the exe** (no GPU on the

design/windows-host-rewrite.md

@@ -250,9 +250,10 @@ then restore + `git worktree remove`. Drive over ssh via `powershell -EncodedCom
 The persistent build validator is the **windows-amd64 CI runner** (no GPU — fine for builds / `iddcx`
 link / `/INTEGRITYCHECK` self-sign / the surface-asserts; live NVENC encode + on-glass defers to the RTX
 box). Workflows: `windows-host.yml` (the host installer), `windows-drivers.yml` (the driver workspace
-build + FORCE_INTEGRITY clear), `windows-drivers-provision.yml` (WDK/LLVM toolchain), `windows-msix.yml`
-(the client). A single Windows runner serializes the whole fleet; a `Cargo.toml` touch costs ~25 min of
-queue, so driver pushes that avoid `Cargo.toml` skip the fleet serialization.
+build + FORCE_INTEGRITY clear; self-provisions the WDK/LLVM toolchain via `scripts/ci/
+ensure-windows-toolchain.ps1`), `windows-msix.yml` (the client). A single Windows runner serializes
+the whole fleet; a `Cargo.toml` touch costs ~25 min of queue, so driver pushes that avoid
+`Cargo.toml` skip the fleet serialization.
 
 Local pre-push checks (this Linux box can't compile the Windows paths):
 ```sh