feat(packaging): signed Inno Setup installer for the Windows host + CI

MSIX (the client's format) can't install the host's LocalSystem secure-desktop
service or the SudoVDA kernel driver, so the host ships as a signed Inno Setup
setup.exe that runs elevated and delegates to the existing idempotent
`punktfunk-host service install`.

- packaging/windows/punktfunk-host.iss: lay exe into Program Files, optional
  SudoVDA driver task, run service install/start; [Code] stops+waits the service
  before file copy on upgrade; uninstall runs service uninstall.
- pack-host-installer.ps1: cert (reuses MSIX_CERT_PFX_B64 / self-signed CN=unom),
  sign inner exe + setup.exe, fetch/stage SudoVDA, run ISCC, export public .cer.
- fetch-sudovda.ps1 / install-sudovda.ps1: pinned SudoVDA + nefcon download, cert
  import, gated device-node create (no phantom dup), pnputil install (warn-not-abort).
- nvenc/: synthesize nvencodeapi.lib via llvm-dlltool from a 2-export .def so
  --features nvenc links with no GPU/SDK at build time.
- .gitea/workflows/windows-host.yml: build (nvenc) -> clippy -> ISCC -> sign ->
  publish setup.exe + .cer to the generic registry pkg punktfunk-host-windows.
  Tag host-win-v* -> X.Y.Z (+ latest/ alias); main push -> rolling 0.2.<run>.
- setup-windows-runner.ps1: provision Inno Setup; docs: installer instructions.

SudoVDA/nefcon release URLs+SHA-256s in fetch-sudovda.ps1 are placeholders
(baseline v0.2.1) — fetch warns + prints the computed hash until pinned.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/ci/setup-windows-runner.ps1

@@ -1,4 +1,4 @@
-# Provision this Windows box as the Gitea Actions runner for the Windows client CI/packaging.
+# Provision this Windows box as the Gitea Actions runner for the Windows client + host CI/packaging.
 # The Windows analogue of scripts/ci/setup-macos-runner.sh. Idempotent — safe to re-run. Run
 # ELEVATED (admin) on the box, e.g. over SSH:
 #
@@ -84,6 +84,16 @@ if (-not (Test-Path "C:\Users\Public\.rustup\settings.toml")) {
     robocopy "$env:USERPROFILE\.rustup" "C:\Users\Public\.rustup" /E /NFL /NDL /NJH /NJS /MT:16 | Out-Null
 }
 
+# Inno Setup (ISCC.exe) for the host installer build (windows-host.yml). pack-host-installer.ps1
+# locates it at its fixed Program Files path, so it need not be on PATH — just present.
+if (-not (Test-Path "C:\Program Files (x86)\Inno Setup 6\ISCC.exe")) {
+    if (Get-Command choco -ErrorAction SilentlyContinue) {
+        Write-Host "==> installing Inno Setup (ISCC)"
+        choco install innosetup -y --no-progress
+    }
+    else { Write-Warning "Inno Setup not found and choco unavailable - install it for windows-host.yml." }
+}
+
 # --- daemon env wrapper (the box's MSVC/WinUI/FFmpeg toolchain) ---
 $wrapper = "$RunnerHome\run-runner.ps1"
 @'