docs(windows): reflect the install-via-exe (Option A) landing in the build/packaging doc

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

design/windows-build-and-packaging.md

@@ -143,17 +143,24 @@ tasks** (all default-checked): install the pf-vdisplay driver, install the gamep
 HDR Vulkan layer, start the service. Silent install: `/VERYSILENT` (omit a task with
 `/MERGETASKS="!installdriver"`).
 
-Install-time work (currently `[Run]` -> `powershell.exe -File install-*.ps1` / `web-setup.ps1`; **being
-moved into `punktfunk-host.exe` subcommands** so there are no locale-parsed PowerShell scripts on the
-end-user box - the root fix for the recurring ANSI-codepage parse breakage, see
-[`windows-service.md`](windows-service.md) for the `service install` precedent):
+Install-time work runs from `punktfunk-host.exe` subcommands, **not** locale-parsed PowerShell *files* -
+the `[Run]` section calls `driver install [--gamepad] --dir <stage>` and `web setup --app-dir <app>
+[--password-file <f>]` (`crates/punktfunk-host/src/windows/install.rs`). This is the ANSI-codepage
+root fix: PowerShell 5.1 reads a BOM-less `.ps1` *file* in the machine codepage, so a stray non-ASCII
+byte aborted the install on a non-English box; a compiled subcommand drives the same external tools as
+fixed string literals (the `service install` precedent, see [`windows-service.md`](windows-service.md)).
+The `.iss`'s *inline* `-Command` PowerShell is a command-line string, not a file read, so it's unaffected
+and stays. Each subcommand is best-effort (a hiccup warns, never aborts the installer):
 
 - **Driver install:** trust the bundled `.cer` (Root + TrustedPublisher), create the `root\pf_vdisplay`
-  node if absent (nefconc, gated so a re-create can't spawn a phantom), `pnputil /add-driver /install`.
-  Best-effort - a driver hiccup never aborts the install (the host degrades to a physical display).
-- **Web console:** write the ACL'd `web-password`, register the `PunktfunkWeb` task (boot, SYSTEM,
-  restart-on-failure -> `bun` on `:3000`), open TCP 3000, start it. Upgrade-safe: stop + reap any old
-  console (by the `:3000` owner, runtime-agnostic) before re-registering so the new one can bind.
+  node if absent (nefconc, gated so a re-create can't spawn a phantom), `pnputil /add-driver /install`
+  (pf-vdisplay) or `pnputil /add-driver` per-inf (gamepads - the host SwDeviceCreate's the devnodes).
+  A driver hiccup never aborts the install (the host degrades to a physical display).
+- **Web console (`web setup`):** write the ACL'd `web-password`, register the `PunktfunkWeb` task (boot,
+  SYSTEM, restart-on-failure -> `bun` on `:3000`, via a generated UTF-16 Task Scheduler XML), open TCP
+  3000, start it. Upgrade-safe: stop + reap any old console (by the `:3000` listener owner, runtime-
+  agnostic - identified by the wildcard foreign address, so the localized state word is never parsed)
+  before re-registering so the new one can bind.
 
 **Signing:** the exe/setup/HDR-layer use the **`MSIX_CERT_PFX_B64`/`MSIX_CERT_PASSWORD`** secrets
 (`CN=unom`, shared with the client); the **drivers** use a separate cert (self-signed per build, or a