desktop: cross-compiled Windows NSIS installer lane (task 2015)

Adds a `windows` job to desktop.yml on the new ci-tauri-win image, producing a
Windows -setup.exe without any Windows hardware. A Windows container can't run
on a Linux host, so cross-compilation is the only route: --runner cargo-xwin
supplies the MSVC CRT/SDK (pre-warmed into the image) and links with lld-link,
and makensis builds the installer.

NSIS only. .msi needs WiX v3, a Windows program — per Tauri, ".msi installers
can only be created on Windows". It comes back if a Windows node ever exists.

Kept as a separate job so a Windows-side failure can never block the Linux
artifacts, which are the primary product today. publish-release.sh now globs
the windows target root too; nullglob means each job uploads only what its own
workspace contains, and the release is created once and reused via the 409
path, so both jobs can publish to the same release safely.

No app code changes were needed. The AppImage self-integration UI already
gates on is_appimage (AccountView.vue:131, DesktopIntegrationPrompt.vue:22),
and $APPIMAGE is never set on Windows, so the OOBE prompt and Settings toggle
hide themselves.

Recorded plainly in ci-requirements.md that this is the weakest-verified lane
we have: Tauri calls Linux->Windows cross-compilation "not tested as much" and
a last resort, and a Linux runner cannot execute a Windows binary. Green means
it built. A real Windows machine check is mandatory before trusting a release,
and installers are unsigned until a certificate exists.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SreJkbxB4gx8pPsu8QbLPi

ci-requirements.md

@@ -82,5 +82,29 @@ backend/frontend push.
   `pacman -U`-tested here. That step logs `.PKGINFO` + the full file listing so
   the package is auditable from the run log; a real Arch install is the operator's
   confirm.
+
+### Windows lane — second job, second image
+
+`desktop.yml` also runs a `windows` job that cross-compiles the NSIS installer.
+
+- **Image:** `git.fabledsword.com/bvandeusen/ci-tauri-win:1.97` (Rust + Node +
+  `cargo-xwin` + LLVM/`lld` + NSIS). A separate image from `ci-tauri` per
+  CI-Runner's `docs/process.md` fork rule — the MSVC CRT/SDK cache alone is >1 GB.
+  Its pins are held in lockstep with `ci-tauri`; bump them together, since both
+  lanes compile the same source.
+- **Why cross-compile:** there is no Windows build host, and a Windows container
+  cannot run on a Linux host (containers share the host kernel). `cargo-xwin`,
+  `lld-link` and `makensis` are Linux programs that emit Windows PE output.
+- **NSIS only.** `.msi` requires WiX v3, a Windows program — per Tauri, "`.msi`
+  installers can only be created on Windows."
+- **Separate job on purpose:** a Windows failure must not block the Linux
+  artifacts, which are the primary product today.
+- **Weakest verification of any lane.** Tauri documents this path as "not as
+  straight forward as compiling on Windows directly and is not tested as much",
+  to be used "only as a last resort" — and a Linux runner cannot execute a
+  Windows binary. Green means it *built*. A real Windows machine check is
+  mandatory before trusting a release.
+- **Unsigned.** Installers will trip SmartScreen until a code-signing
+  certificate exists; that is a purchasing decision, not a CI one.
 - No Postgres lane (unchanged): the desktop app's local store + sync behavior is
   verified on the operator's machine, not in CI.