fix(windows-installer): build pf-vdisplay from source in CI; ASCII scripts; upgrade-safe web console

The pf-vdisplay virtual-display driver shipped as a checked-in PREBUILT binary
that went stale - two field failures on a fresh install (live-repro'd on a
German-locale Dell laptop):

  * Bug A (every box): a repo-wide rename edited the vendored pf_vdisplay.inf
    but never re-signed pf_vdisplay.cat, so the catalog stopped covering the INF
    -> `pnputil /add-driver` fails SPAPI_E_FILE_HASH_NOT_IN_CATALOG -> driver
    never installs -> every session dies "pf-vdisplay driver interface not
    found".
  * the prebuilt binary also predated IOCTL_SET_RENDER_ADAPTER (added to the
    driver source after the vendor freeze) that the host needs to pin the IDD
    render GPU on hybrid/Optimus boxes.

Fix: build the driver FROM SOURCE every release (build-pf-vdisplay.ps1, wired
into pack-host-installer.ps1) so .dll/.inf/.cat are always in lockstep and
current driver features ship. The runner's clang 22 made the driver's pinned
bindgen 0.71 emit opaque structs (157 layout-assert errors), so bump the
vendored wdk-sys/wdk-build bindgen 0.71 -> 0.72 (+ lock). The build self-signs
the driver per build (installer trusts the bundled .cer); a stable
DRIVER_CERT_PFX_B64 secret can override.

  * Bug B (non-English boxes): the installer runs install-pf-vdisplay.ps1 etc.
    via powershell.exe (5.1), which reads a BOM-less script in the ANSI codepage
    - an em-dash's trailing 0x94 byte becomes a curly quote on German
    Windows-1252 and the script aborts "unterminated string", so the driver
    never installed (the gamepad script survived only because it was already
    ASCII). Scrub every installer-run .ps1/.cmd to ASCII + add a CI gate that
    fails on any non-ASCII so it can't regress.

  * Bug C (upgrades): nothing stopped the OLD web console before re-registering
    its task, so a stale server kept :3000 (the new one restart-looped on
    EADDRINUSE) and served a broken old bundle (500 on /login). Stop + reap it
    (runtime-agnostic, by the :3000 listener owner) in web-setup.ps1 and in the
    .iss before the file copy + on uninstall.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packaging/windows/install-pf-vdisplay.ps1

@@ -1,19 +1,20 @@
 <#
 .SYNOPSIS
-  Install the bundled pf-vdisplay (punktfunk) virtual-display driver — our all-Rust IddCx replacement
-  for SudoVDA. Runs ELEVATED at setup time (invoked from the installer's [Run] section). Best-effort:
-  warns and exits 0 on any failure — the host degrades to a physical display without a virtual display,
-  so a driver hiccup must never abort the whole install.
+  Install the bundled pf-vdisplay (punktfunk) virtual-display driver - our own all-Rust UMDF IddCx
+  indirect-display driver, built from source per release (packaging/windows/build-pf-vdisplay.ps1).
+  Runs ELEVATED at setup time (invoked from the installer's [Run] section). Best-effort: warns and exits
+  0 on any failure - the host degrades to a physical display without a virtual display, so a driver
+  hiccup must never abort the whole install.
 
 .DESCRIPTION
   -Dir holds the staged payload (pf_vdisplay.inf/.cat/.dll + signing .cer + nefconc.exe). Steps:
     1. Trust the self-signed driver cert (machine Root + TrustedPublisher) so PnP installs it silently
-       (the same punktfunk-ds-test cert the gamepad drivers ship).
-    2. Create the ROOT device node IF ABSENT (gated — a blind re-create spawns a phantom duplicate, and
-       the host's open_device() binds interface index 0; crates/punktfunk-host/src/vdisplay/sudovda.rs).
-       ALWAYS via nefconc (a clean ROOT\DISPLAY node) — NEVER devgen, which makes persistent SWD\DEVGEN
+       (the punktfunk-driver cert the build signs the driver + catalog with).
+    2. Create the ROOT device node IF ABSENT (gated - a blind re-create spawns a phantom duplicate, and
+       the host's open_device() binds interface index 0; crates/punktfunk-host/src/vdisplay/windows/pf_vdisplay.rs).
+       ALWAYS via nefconc (a clean ROOT\DISPLAY node) - NEVER devgen, which makes persistent SWD\DEVGEN
        software devices that survive reboot + registry deletion and resurrect on every driver install.
-    3. Stage + bind the driver (pnputil /add-driver /install — modern, in-box, idempotent).
+    3. Stage + bind the driver (pnputil /add-driver /install - modern, in-box, idempotent).
 
   Class/ClassGuid are read from the .inf so they always match the shipped driver.
 
@@ -52,11 +53,11 @@ if ($cer) {
     certutil.exe -addstore -f Root "$($cer.FullName)" | Out-Null
     certutil.exe -addstore -f TrustedPublisher "$($cer.FullName)" | Out-Null
 }
-else { Write-Warning "no .cer in $Dir — driver may not install silently (untrusted publisher)" }
+else { Write-Warning "no .cer in $Dir - driver may not install silently (untrusted publisher)" }
 
 # 2) Create the root device node only if it isn't already there. nefconc, NEVER devgen.
 if (Test-PfVdisplayPresent) {
-    Write-Host "pf-vdisplay device node already present — leaving it as-is."
+    Write-Host "pf-vdisplay device node already present - leaving it as-is."
 }
 elseif ($nef) {
     $infText = Get-Content -Raw $inf.FullName
@@ -69,7 +70,7 @@ elseif ($nef) {
         Write-Warning "nefconc --create-device-node returned $LASTEXITCODE"
     }
 }
-else { Write-Warning "nefconc.exe not found in $Dir — cannot create the pf-vdisplay device node." }
+else { Write-Warning "nefconc.exe not found in $Dir - cannot create the pf-vdisplay device node." }
 
 # 3) Stage + bind the driver (idempotent; re-staging the same .inf is harmless).
 Write-Host "==> pnputil /add-driver $($inf.Name) /install"