feat(host/windows): WGC helper subcommand (two-process secure-desktop, step 3)

`m3-host wgc-helper --target-id N --gdi NAME --mode WxHxHz --bitrate K`: the
USER-session half of the two-process secure-desktop design
(docs/windows-secure-desktop.md). Opens WGC on the EXISTING SudoVDA output by
GDI name only (never creates a virtual output — a second topology owner re-trips
the ACCESS_LOST born-lost storm), encodes via NVENC, and ships framed Annex-B
AUs on stdout for the SYSTEM host to relay onto the live QUIC session:
`[u32 magic "PFAU"][u32 len][u64 pts_ns][u8 keyframe][data]`. tracing → stderr so
stdout stays the pure AU stream. cfg-gated windows-only; Linux build unaffected.

scripts/headless/win-build.cmd: the canonical box build script (sets
PUNKTFUNK_BUILD_VERSION so build.rs stamps the version + the NVENC LIB path).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/headless/win-build.cmd

@@ -0,0 +1,8 @@
+@echo off
+call "C:\Program Files\Microsoft Visual Studio\18\Community\VC\Auxiliary\Build\vcvars64.bat" >nul 2>&1
+set "LIB=%LIB%;C:\Users\Public\nvenc"
+set "PATH=%USERPROFILE%\.cargo\bin;%PATH%"
+set "PUNKTFUNK_BUILD_VERSION=0.2.0-win-dev"
+cd /d C:\Users\Public\punktfunk-native
+cargo build -r -p punktfunk-host --features nvenc 2>&1
+echo BUILD_EXIT=%ERRORLEVEL%