ci(windows): restore paths filter + document global runner scope

Re-add the paths filter (the trigger was never the problem — the runner was registered at the
wrong scope, so org-repo runs found 'no fitting runner' despite the runner showing idle). Document
in setup-windows-runner.ps1 that the registration token must be GLOBAL (Site Administration ->
Actions -> Runners), like the Linux runner. CARGO_WORKSPACE_DIR is set via GITHUB_ENV in a step
(the job-env ${{ github.workspace }} form didn't resolve, leaving it unset -> reactor build.rs
panic).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/ci/setup-windows-runner.ps1

@@ -10,7 +10,11 @@
 # daemon alive across reboots with nobody logged in. Registration happens once (.runner file); the
 # token is NOT persisted.
 #
-# Get the token from Gitea: org **unom** -> Settings -> Actions -> Runners -> "Create new runner".
+# Get a **GLOBAL** registration token: Gitea **Site Administration -> Actions -> Runners** (the
+# registration token shown there). The runner MUST be global/instance-scoped to pick up org-repo
+# jobs like unom/punktfunk — an org- or repo-scoped token leaves it registered but unmatchable
+# ("no fitting runner for windows-amd64", even though the runner shows idle). Mirrors the Linux
+# runner's scope.
 #
 # Env/param knobs: -Instance (default https://git.unom.io), -Token (GITEA_RUNNER_TOKEN; required
 # for first registration), -RunnerName (default COMPUTERNAME), -Labels (default windows-amd64:host
@@ -64,8 +68,8 @@ Pop-Location
 # --- one-time registration (from $RunnerHome: register writes .runner to the CWD) ---
 if (-not (Test-Path "$RunnerHome\.runner")) {
     if (-not $Token) {
-        Write-Warning "Not registered yet. Re-run with -Token <registration token>."
-        Write-Host "  (Gitea: org unom -> Settings -> Actions -> Runners -> Create new runner)"
+        Write-Warning "Not registered yet. Re-run with -Token <GLOBAL registration token>."
+        Write-Host "  (Gitea: Site Administration -> Actions -> Runners -> registration token; must be GLOBAL scope)"
         exit 1
     }
     Push-Location $RunnerHome