feat(windows-ci): self-provisioning toolchain for the shared unom/infra runner

The Windows CI runner (home-windows-runner-1, vmid 210) is now provisioned/owned by
unom/infra and can be rebuilt or joined by additional windows-amd64-labeled runners at
any time - a manually-dispatched provisioning workflow has no way to target a specific
runner instance, so it could land on an already-provisioned box instead of the one that
needed it. Replace windows-drivers-provision.yml / windows-punktfunk-provision.yml with
scripts/ci/ensure-windows-toolchain.ps1, a shared idempotent pre-flight (WDK/cargo-wdk,
FFmpeg, Inno Setup, ARM64 rustup target) that every Windows workflow now runs at job
start - a fast no-op once already provisioned, so any runner self-heals on first real use.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/ci/provision-windows-wdk.ps1

@@ -7,8 +7,11 @@
 # Idempotent: skips the WDK install if the km/wdf headers are already present, and cargo-wdk if already
 # installed. Safe to run repeatedly. Runs non-interactively (/q /norestart) — never auto-reboots.
 #
-# Invoked by .gitea/workflows/windows-drivers-provision.yml (workflow_dispatch) and referenced by
-# scripts/ci/setup-windows-runner.ps1. Run as the runner's account (SYSTEM) with admin rights.
+# Invoked by scripts/ci/ensure-windows-toolchain.ps1, the shared self-provision step every Windows
+# CI workflow runs at job start (windows-drivers.yml, windows.yml, windows-msix.yml,
+# windows-host.yml), on top of the generic runner unom/infra provisions (windows-runner/) and
+# provision-windows-punktfunk-extras.ps1's FFmpeg/Inno Setup/ARM64-target layer. Run as the
+# runner's account (SYSTEM) with admin rights.
 [CmdletBinding()]
 param(
   # WDK 26100 standalone bootstrapper. Source: https://learn.microsoft.com/windows-hardware/drivers/download-the-wdk