feat(windows-host): mic passthrough — auto-wire audio devices + bundle VB-CABLE

The Windows virtual mic worked only with manual Sound-settings fiddling: on a
headless host (no real audio output) BOTH the desktop-audio loopback and the
virtual mic must run on virtual cables, and on DIFFERENT ones or the loopback
re-captures the injected mic (echo). The Steam pair gives only one usable cable
(Steam Streaming Speakers loopback is silent — validated), so the mic + loopback
collided and echoed, and when the default playback happened to be the mic device
the anti-echo guard reported the mic "unavailable".

Host now auto-wires the devices at startup (audio/windows/audio_control.rs,
ensure_wired_once, hooked from open_audio_capture/open_virtual_mic): default
playback = a loopback-capable render that is NOT a cable and NOT the dead Steam
Speakers (real output > Steam Streaming Microphone); default recording = the mic
capture (VB-Cable "CABLE Output" preferred). Uses a hand-rolled IPolicyConfig
vtable (the only way to set a default endpoint; not in windows/wasapi crates).
Opt out with PUNKTFUNK_KEEP_DEFAULT. wasapi_mic candidates now prefer "cable
input". Validated live: from a deliberately-wrong start (playback=CABLE Input)
the host corrected both default endpoints at the OS level.

A Windows audio endpoint can only be created by a kernel-mode driver (no UMDF
path — ACX is KMDF-only), so we cannot self-sign our own like the UMDF gamepad/
display drivers. Instead the installer bundles + silently installs the official
base VB-CABLE (VB-Audio donationware, vendor-signed → loads with no test-signing,
redistributed under VB-Audio's bundling grant): install-vbcable.ps1 (seed the
VB-Audio cert into TrustedPublisher, run -i -h) + an installaudiocable task,
gated on -VbCableDir/$env:VBCABLE_DIR (the package binary is not in the repo).
Attribution in packaging/windows/licenses/VB-CABLE-NOTICE.txt. .iss compiles
with the path enabled.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packaging/windows/pack-host-installer.ps1

@@ -28,6 +28,7 @@ param(
     [string]$FfmpegDir = $env:FFMPEG_DIR,                           # bundle its bin\*.dll (amf-qsv build)
     [string]$WebDir = $env:WEB_OUTPUT_DIR,                          # built web .output tree -> bundle the mgmt console
     [string]$BunExe = $env:BUN_EXE,                                # portable bun.exe runtime for the console
+    [string]$VbCableDir = $env:VBCABLE_DIR,                         # official base VB-CABLE package -> bundle the virtual mic
     [switch]$NoDriver,                                              # build without the bundled pf-vdisplay driver
     [switch]$NoSign                                                 # skip signing (local debug)
 )
@@ -189,6 +190,29 @@ if (-not $NoDriver) {
     Write-Host "==> built + staged gamepad UMDF drivers -> $gpStage"
 }
 
+# --- stage the official base VB-CABLE package (the streaming virtual microphone) --------------
+# VB-CABLE is the virtual audio cable the host writes the client's mic into (its capture endpoint then
+# surfaces as a host microphone). We bundle + silently install the OFFICIAL base VB-CABLE package
+# (VB-Audio donationware, redistributed under VB-Audio's bundling grant - see the VB-CABLE notice added
+# to the licenses payload). The package binary is NOT in the repo (it's a signed third-party blob,
+# shipped intact); supply it via -VbCableDir / $env:VBCABLE_DIR pointing at the extracted official
+# package (must contain VBCABLE_Setup_x64.exe). Absent -> installer built WITHOUT the bundled cable; the
+# host then auto-installs the Steam Streaming pair as a fallback and mic passthrough needs a manual cable.
+if ($VbCableDir -and (Test-Path $VbCableDir) -and (Get-ChildItem -Path $VbCableDir -Filter 'VBCABLE_Setup*.exe' -ErrorAction SilentlyContinue)) {
+    $vbStage = Join-Path $OutDir 'vbcable'
+    if (Test-Path $vbStage) { Remove-Item -Recurse -Force $vbStage }
+    New-Item -ItemType Directory -Force -Path $vbStage | Out-Null
+    Copy-Item (Join-Path $VbCableDir '*') $vbStage -Recurse -Force
+    # The on-target installer script (seeds VB-Audio's cert into TrustedPublisher, runs -i -h) ships
+    # alongside the package so it's extracted to the same {tmp}\vbcable dir.
+    Copy-Item (Join-Path $here 'install-vbcable.ps1') $vbStage -Force
+    $defines += "/DAudioCableStageDir=$vbStage"
+    # Attribution: VB-Audio's bundling grant requires we surface VB-CABLE's origin + donationware status.
+    Copy-Item (Join-Path $here 'licenses\VB-CABLE-NOTICE.txt') -Destination $licStage -Force
+    Write-Host "==> bundling VB-CABLE (virtual mic) from $VbCableDir -> $vbStage"
+}
+else { Write-Host "no -VbCableDir/`$env:VBCABLE_DIR (or no VBCABLE_Setup*.exe in it) -> installer built WITHOUT the bundled VB-CABLE virtual mic" }
+
 # --- stage the FFmpeg shared DLLs (AMD/Intel AMF/QSV build) ------------------------------------
 # A host built with --features amf-qsv link-imports avcodec/avutil/swscale/... so the shared DLLs
 # MUST sit next to the exe (it won't start otherwise). Bundle them from $FfmpegDir\bin - the same