feat(windows-client): cross-compile + ship ARM64 (aarch64) off the x64 runner

windows.yml + windows-msix.yml gain an x86_64/aarch64 target matrix. ARM64 is
cross-compiled on the one x64 Windows runner — the x64 MSVC toolset ships the
ARM64 cross compiler, aarch64-pc-windows-msvc is tier-2 with host tools, and
SDL3/libopus (build-from-source) cross-compile cleanly. The only arch-specific
external dep is FFmpeg's import libs: the matrix points FFMPEG_DIR at a per-arch
tree (x64 C:\Users\Public\ffmpeg, arm64 C:\Users\Public\ffmpeg-arm64, both
FFmpeg 7.x / avcodec-61). Per-arch short CARGO_TARGET_DIR avoids a shared target
dir; fmt + test run only for x64 (aarch64 can't execute on the x64 host).

pack-msix.ps1 gains -Arch x64|arm64 (stamps the manifest ProcessorArchitecture,
arch-suffixes the .msix/.cer); windows-msix.yml matrixes both arches and
publishes ..._x64.msix / ..._arm64.msix. setup-windows-runner.ps1 provisions the
rustup target + the ARM64 FFmpeg tree (idempotent).

Verified live on the runner (home-windows-1): debug+release cross-build green,
clippy -D warnings green, and MSIX pack produces a valid arm64 package (manifest
arch=arm64; bundled exe/SDL3/avcodec/reactor-bootstrap all PE machine 0xAA64).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

clients/windows/packaging/AppxManifest.xml

@@ -26,7 +26,7 @@
     Name="unom.Punktfunk"
     Publisher="{PUBLISHER}"
     Version="{VERSION}"
-    ProcessorArchitecture="x64" />
+    ProcessorArchitecture="{ARCH}" />
 
   <Properties>
     <DisplayName>Punktfunk</DisplayName>

clients/windows/packaging/README.md

@@ -1,11 +1,19 @@
 # punktfunk Windows client — MSIX packaging
 
-The Windows client ships as a **signed MSIX** so Windows boxes get a real package (Start tile,
-clean install/uninstall) instead of a loose exe. CI builds + publishes it from
+The Windows client ships as **signed MSIX** packages so Windows boxes get a real package (Start
+tile, clean install/uninstall) instead of a loose exe. CI builds + publishes them from
 [`.gitea/workflows/windows-msix.yml`](../../../.gitea/workflows/windows-msix.yml) to Gitea's
 **generic** package registry (`https://git.unom.io/unom/-/packages`), on every `main` push that
 touches the client and on `win-v*` release tags.
 
+**Two architectures, one x64 runner.** Both `x64` and `arm64` packages are produced off the single
+x64 Windows runner — `x86_64-pc-windows-msvc` builds natively, `aarch64-pc-windows-msvc` is
+cross-compiled (the x64 MSVC toolset ships the ARM64 cross compiler; the matrix points `FFMPEG_DIR`
+at the runner's ARM64 FFmpeg tree, `C:\Users\Public\ffmpeg-arm64`). Artifacts are arch-suffixed
+(`..._x64.msix` / `..._arm64.msix`, each with its matching `.cer`); `pack-msix.ps1 -Arch x64|arm64`
+stamps the manifest `ProcessorArchitecture` and names the output. See
+[`windows.yml`](../../../.gitea/workflows/windows.yml) for the cross-build rationale.
+
 ## What's in the package
 
 `pack-msix.ps1` assembles a layout from a `cargo build --release` and runs `makeappx` + `signtool`:
@@ -47,8 +55,9 @@ trusted with no further prompt:
 ```powershell
 # once per machine (elevated): trust the publisher
 Import-Certificate -FilePath .\punktfunk-codesign.cer -CertStoreLocation Cert:\LocalMachine\TrustedPeople
-# then install (and re-run for each upgrade — no re-trust needed)
-Add-AppxPackage -Path .\punktfunk-client-windows_<ver>_x64.msix
+# then install the package for your CPU (and re-run for each upgrade — no re-trust needed)
+Add-AppxPackage -Path .\punktfunk-client-windows_<ver>_x64.msix     # Intel/AMD
+Add-AppxPackage -Path .\punktfunk-client-windows_<ver>_arm64.msix   # ARM64 (Snapdragon, etc.)
 ```
 
 The matching `.cer` is also published next to each `.msix` in the registry, so it's always at hand.
@@ -70,9 +79,16 @@ it changes the package identity → a one-time reinstall).
 On the Windows runner / dev VM (MSVC + Windows SDK present), after a release build:
 
 ```powershell
-cargo build --release -p punktfunk-client-windows
+# x64
+cargo build --release -p punktfunk-client-windows --target x86_64-pc-windows-msvc
 pwsh -File clients/windows/packaging/pack-msix.ps1 `
-  -Version 0.2.0.0 -TargetDir C:\t\release -OutDir C:\t\msix
+  -Version 0.2.0.0 -TargetDir C:\t\x86_64-pc-windows-msvc\release -OutDir C:\t\msix
+
+# arm64 (cross-compiled; point FFMPEG_DIR at the ARM64 tree)
+$env:FFMPEG_DIR = 'C:\Users\Public\ffmpeg-arm64'
+cargo build --release -p punktfunk-client-windows --target aarch64-pc-windows-msvc
+pwsh -File clients/windows/packaging/pack-msix.ps1 `
+  -Version 0.2.0.0 -Arch arm64 -TargetDir C:\t\aarch64-pc-windows-msvc\release -OutDir C:\t\msix
 ```
 
 Validated end-to-end on the build VM (pack → sign → `Add-AppxPackage` → framework-dependency

clients/windows/packaging/pack-msix.ps1

@@ -18,12 +18,17 @@
   Run on the Windows runner (or the dev VM) with the MSVC/Windows SDK present.
 
 .EXAMPLE
-  pwsh -File pack-msix.ps1 -Version 0.2.137.0 -TargetDir C:\t\release -FfmpegBin C:\Users\Public\ffmpeg\bin -OutDir C:\t\msix
+  # x64 (default arch):
+  pwsh -File pack-msix.ps1 -Version 0.2.137.0 -TargetDir C:\t\x86_64-pc-windows-msvc\release -OutDir C:\t\msix
+  # arm64 (point -TargetDir + FFMPEG_DIR at the ARM64 build/tree):
+  $env:FFMPEG_DIR='C:\Users\Public\ffmpeg-arm64'
+  pwsh -File pack-msix.ps1 -Version 0.2.137.0 -Arch arm64 -TargetDir C:\t-a64\aarch64-pc-windows-msvc\release -OutDir C:\t-a64\msix
 #>
 [CmdletBinding()]
 param(
     [Parameter(Mandatory = $true)][string]$Version,                     # 4-part numeric, e.g. 0.2.137.0
     [Parameter(Mandatory = $true)][string]$TargetDir,                   # cargo --release output dir (has the exe)
+    [ValidateSet('x64', 'arm64')][string]$Arch = 'x64',                 # package ProcessorArchitecture + artifact suffix
     [string]$FfmpegBin = $(if ($env:FFMPEG_DIR) { Join-Path $env:FFMPEG_DIR 'bin' } else { 'C:\Users\Public\ffmpeg\bin' }),
     [string]$OutDir = (Join-Path $TargetDir 'msix'),
     [string]$Publisher = 'CN=unom',                                     # MUST equal the signing cert subject DN
@@ -79,8 +84,8 @@ $ff | ForEach-Object { Copy-Item $_.FullName (Join-Path $layout $_.Name) -Force
 # tile/store assets
 Copy-Item (Join-Path $assets '*') (Join-Path $layout 'Assets') -Force
 
-# manifest with version + publisher substituted
-$manifest = (Get-Content -Raw $manifestTemplate).Replace('{VERSION}', $Version).Replace('{PUBLISHER}', $Publisher)
+# manifest with version + publisher + architecture substituted
+$manifest = (Get-Content -Raw $manifestTemplate).Replace('{VERSION}', $Version).Replace('{PUBLISHER}', $Publisher).Replace('{ARCH}', $Arch)
 Set-Content -Path (Join-Path $layout 'AppxManifest.xml') -Value $manifest -Encoding UTF8
 
 Write-Host "layout assembled at $layout :"
@@ -88,13 +93,13 @@ Get-ChildItem $layout -Recurse -File | ForEach-Object { "  $($_.FullName.Substri
 
 # --- pack ---
 New-Item -ItemType Directory -Force -Path $OutDir | Out-Null
-$msix = Join-Path $OutDir "punktfunk-client-windows_${Version}_x64.msix"
+$msix = Join-Path $OutDir "punktfunk-client-windows_${Version}_${Arch}.msix"
 & $makeappx pack /o /d $layout /p $msix
 if ($LASTEXITCODE -ne 0) { throw "makeappx pack failed ($LASTEXITCODE)" }
 
 # --- signing cert (supplied stable pfx OR ephemeral self-signed) ---
 $pfxPath = Join-Path $OutDir 'signing.pfx'
-$cerPath = Join-Path $OutDir "punktfunk-client-windows_${Version}_x64.cer"
+$cerPath = Join-Path $OutDir "punktfunk-client-windows_${Version}_${Arch}.cer"
 if ($PfxBase64) {
     Write-Host "signing with supplied code-signing cert (MSIX_CERT_PFX_B64)"
     [IO.File]::WriteAllBytes($pfxPath, [Convert]::FromBase64String($PfxBase64))