chore(client): the windows-rs pin moves a month forward, onto the SDK-metadata bindings

The July 2026 windows-rs brings a reconciler keyed-child-order fix (#4728), widget
validation (#4727), a DPI collision fix (#4751), icon elements (#4736), multi-window
support (#4730) and scroll virtualization (#4710) — the re-render fixes the Windows
client has been working around at the architecture level. All three pinned deps
(windows-reactor, windows, windows-reactor-setup) move together so windows-core
stays unified across the swap-chain hand-off, and pf-client-core moves with them.

The bulk of the diff is #4689: windows/windows-sys now generate straight from the
Windows SDK, so the `Win32_*` namespace features became one feature per SDK header
(winuser, dxgi, d3d11, …), the PascalCase namespace modules became header-named
modules, struct-returning COM methods take explicit out-params and return HRESULT,
Win32 functions return their raw BOOL/HANDLE instead of Result, and flag constants
are plain integers. Both crates' Win32 code is rewritten to that shape; behaviour
is unchanged on every path.

Riding along, all already stale before the bump: the README and the three Windows
workflows stop claiming windows-reactor's build.rs needs CARGO_WORKSPACE_DIR (that
build.rs no longer exists — staging moved to windows-reactor-setup via OUT_DIR);
the README layout section stops describing modules that moved into the session
binary long ago and gains the manual smoke checklist; the notices generator learns
the SPDX for crates that ship license files without a `license` field, which turns
windows-reactor-setup's UNKNOWN into MIT OR Apache-2.0; and the crate records its
real rust-version (1.96) instead of inheriting the workspace's 1.82.

Verified: cargo check/clippy/fmt clean on punktfunk-client-windows, pf-client-core
and punktfunk-client-session; both bins build; --discover finds the LAN hosts; the
GUI shell comes up (WinAppSDK bootstrap intact under the new reactor-setup).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/gen-third-party-notices.py

@@ -45,6 +45,13 @@ def find_license_files(pkg_dir):
     return out
 
 
+# Crates that ship license-mit/license-apache-2.0 files but omit the `license` field in
+# their Cargo.toml (publish = false upstream), so `cargo metadata` reports no SPDX for them.
+LICENSE_OVERRIDES = {
+    "windows-reactor-setup": "MIT OR Apache-2.0",
+}
+
+
 # Third-party source trees VENDORED inside first-party workspace crates — the
 # workspace-member skip in main() hides them from `cargo metadata`, so they are listed
 # here explicitly: (label, license file relative to the repo root, source URL).
@@ -146,7 +153,7 @@ def main():
     w("MANIFEST (crate version — SPDX license — source)")
     w("-" * 76)
     for p in pkgs:
-        lic = p.get("license") or (("file: " + p["license_file"]) if p.get("license_file") else "UNKNOWN")
+        lic = p.get("license") or LICENSE_OVERRIDES.get(p["name"]) or (("file: " + p["license_file"]) if p.get("license_file") else "UNKNOWN")
         repo = p.get("repository") or ""
         w(f'  {p["name"]} {p["version"]} — {lic}' + (f' — {repo}' if repo else ""))
     w("")
@@ -156,7 +163,7 @@ def main():
         w("Crates whose package did not embed a license file (SPDX + source only)")
         w("-" * 76)
         for p in no_text:
-            lic = p.get("license") or "UNKNOWN"
+            lic = p.get("license") or LICENSE_OVERRIDES.get(p["name"]) or "UNKNOWN"
             repo = p.get("repository") or ""
             w(f'  {p["name"]} {p["version"]} — {lic}' + (f' — {repo}' if repo else ""))
         w("")