feat(windows): bundle pf-vdisplay in the host installer; drop SudoVDA

Switch the Inno Setup installer's virtual-display driver from the vendored SudoVDA
C++ binary to our own all-Rust pf-vdisplay (validated streaming at 5120x1440@240).

- packaging/windows/pf-vdisplay/: vendored SIGNED driver (pf_vdisplay.dll/inf/cat +
  punktfunk-driver.cer, the same cert the gamepad drivers ship), built from
  vdisplay-driver/ via deploy-dev.ps1.
- install-pf-vdisplay.ps1 / stage-pf-vdisplay.ps1: mirror the SudoVDA scripts -
  trust cert -> gated ROOT\pf_vdisplay node via nefconc (NEVER devgen) -> pnputil
  /add-driver /install. Idempotent, best-effort (never aborts the install).
- punktfunk-host.iss + pack-host-installer.ps1: install the pf-vdisplay bundle
  under the existing installdriver task.
- Removed the vendored SudoVDA driver + install-sudovda.ps1 + stage-sudovda.ps1.
- README + windows-host.yml: SudoVDA -> pf-vdisplay.

The host's vdisplay/sudovda.rs backend is unchanged - it drives whichever driver
provides the {e5bcc234} interface, now pf-vdisplay. Live installer build/test on
the runner is the remaining step.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packaging/windows/stage-pf-vdisplay.ps1

@@ -0,0 +1,68 @@
+<#
+.SYNOPSIS
+  Stage the pf-vdisplay driver bundle the installer ships into -OutDir: the VENDORED signed pf-vdisplay
+  driver + the fetched nefcon device tool.
+
+.DESCRIPTION
+  pf-vdisplay (our all-Rust IddCx virtual display) is built from packaging/windows/vdisplay-driver/, and
+  the SIGNED output (pf_vdisplay.dll/.inf/.cat + punktfunk-driver.cer) is VENDORED under
+  packaging/windows/pf-vdisplay/ (signer punktfunk-ds-test — shared with the gamepad drivers — Class=
+  Display, HWID root\pf_vdisplay). Rebuild + re-vendor with
+  packaging/windows/vdisplay-driver/deploy-dev.ps1 when the driver source changes, then copy the staged
+  pf_vdisplay.{dll,inf,cat} over the vendored copies. nefcon publishes a pinned release, so we fetch +
+  SHA-256-verify it (it provides nefconc.exe, used to create the root-enumerated device node — pnputil
+  can't).
+
+  Output (consumed by punktfunk-host.iss): -OutDir gets pf_vdisplay.inf/.cat/.dll + punktfunk-driver.cer
+  and nefconc.exe (x64). pack-host-installer.ps1 also drops install-pf-vdisplay.ps1 in.
+
+.EXAMPLE
+  pwsh -File stage-pf-vdisplay.ps1 -OutDir C:\t\out\stage
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory = $true)][string]$OutDir,
+    [string]$VendorDir = (Join-Path $PSScriptRoot 'pf-vdisplay'),
+    # PINNED nefcon release (https://github.com/nefarius/nefcon/releases). MIT-licensed.
+    [string]$NefconUrl = 'https://github.com/nefarius/nefcon/releases/download/v1.17.40/nefcon_v1.17.40.zip',
+    [string]$NefconSha256 = '812bae7ed7dfb7d6d2284bc7de2f8ccebc92ed2a0b1ae893c53b337096e50c1a'
+)
+$ErrorActionPreference = 'Stop'
+$ProgressPreference = 'SilentlyContinue'
+$PSNativeCommandUseErrorActionPreference = $false
+
+if (Test-Path $OutDir) { Remove-Item -Recurse -Force $OutDir }
+New-Item -ItemType Directory -Force -Path $OutDir | Out-Null
+
+# --- vendored pf-vdisplay driver --------------------------------------------------------------
+$inf = Get-ChildItem -Path $VendorDir -Filter pf_vdisplay.inf -ErrorAction SilentlyContinue | Select-Object -First 1
+if (-not $inf) { throw "no vendored pf_vdisplay.inf under $VendorDir — re-vendor via vdisplay-driver/deploy-dev.ps1" }
+Copy-Item (Join-Path $VendorDir '*') $OutDir -Force
+Write-Host "==> vendored pf-vdisplay staged from $VendorDir"
+
+# --- nefcon (fetched + verified) --------------------------------------------------------------
+$work = Join-Path ([IO.Path]::GetTempPath()) ('nefcon-' + [IO.Path]::GetRandomFileName())
+New-Item -ItemType Directory -Force -Path $work | Out-Null
+try {
+    $zip = Join-Path $work 'nefcon.zip'
+    Write-Host "==> downloading $NefconUrl"
+    Invoke-WebRequest -Uri $NefconUrl -OutFile $zip -UseBasicParsing
+    $got = (Get-FileHash $zip -Algorithm SHA256).Hash.ToLowerInvariant()
+    if ($NefconSha256) {
+        if ($got -ne $NefconSha256.ToLowerInvariant()) {
+            throw "nefcon SHA-256 mismatch`n  expected $NefconSha256`n  got      $got"
+        }
+        Write-Host "    sha256 ok ($got)"
+    }
+    else { Write-Warning "no pinned nefcon SHA-256 — computed $got (PIN THIS in stage-pf-vdisplay.ps1)" }
+    Expand-Archive -Path $zip -DestinationPath $work -Force
+    $nefc = Get-ChildItem -Path $work -Recurse -Filter 'nefconc.exe' |
+        Where-Object { $_.FullName -match '(?i)\\x64\\' } | Select-Object -First 1
+    if (-not $nefc) { $nefc = Get-ChildItem -Path $work -Recurse -Filter 'nefconc.exe' | Select-Object -First 1 }
+    if (-not $nefc) { throw "nefconc.exe not found in $NefconUrl" }
+    Copy-Item $nefc.FullName (Join-Path $OutDir 'nefconc.exe') -Force
+}
+finally { Remove-Item -Recurse -Force $work -ErrorAction SilentlyContinue }
+
+Write-Host "==> staged driver bundle in $OutDir :"
+Get-ChildItem $OutDir -File | ForEach-Object { "    $($_.Name)" }