feat: build Windows desktop app in Node 24 CI

[coconilu]

What changed

• add a Windows desktop-build workflow using Node.js 24, Python 3.12, Rust, Tauri, and NSIS
• upload exactly one unsigned current-user installer plus its SHA-256 as a 14-day Actions artifact
• document the local build, GitHub build, installation boundary, and absence of a portable/green build
• add desktop workflow and cross-PowerShell hashing contract tests
• fix the privacy scanner so extensionless binary Cargo metadata is not misclassified as a path escape
• calculate build hashes through .NET SHA-256 instead of relying on the optional Get-FileHash cmdlet

Why

The desktop source was buildable locally but had no GitHub workflow that produced a downloadable Windows installer. A real local build also exposed an exception-order bug: UnicodeDecodeError inherits from ValueError, so extensionless Cargo metadata was incorrectly reported as SCAN_PATH_ESCAPED.

The first GitHub run reached PyInstaller successfully but showed that its Windows PowerShell environment did not expose Get-FileHash. The follow-up commit replaces that cmdlet dependency with System.Security.Cryptography.SHA256.ComputeHash, verified under Windows PowerShell 5.1 and PowerShell 7.

Impact and boundaries

• the workflow has only contents: read
• it does not sign, publish a GitHub Release, or claim production/Store readiness
• the installer remains an unsigned development artifact
• no portable/green distribution is claimed
• generated artifacts and private .opc state remain outside Git

Validation

• local Node.js 24 Tauri/NSIS build passed after the runner-compatibility fix
• Windows PowerShell 5.1 sidecar build and .NET SHA-256 output passed
• sidecar smoke test passed with root and /api/app-context returning HTTP 200 on random loopback
• 431 tests passed, 6 platform-conditional skips
• repository validation passed
• privacy scan passed
• official Plugin validator passed
• all 7 Skill quick validators passed
• actionlint passed

Risk and rollback

The primary risk is Windows runner/toolchain drift or an unsigned installer triggering SmartScreen. Rollback is removal of .github/workflows/desktop-build.yml and the associated documentation/test changes; no user data or global Agent configuration is modified.

Final remote delivery evidence

• final head: 8726bf5676463719f02920c94c88e6f9f22d7f9e
• Node 24 desktop run: https://github.com/coconilu/codex-opc-team/actions/runs/30198832180 (success, 4m08s)
• artifact upload uses actions/upload-artifact@v7; the earlier Node 20 compatibility warning is gone
• artifact: opc-app-windows-x64-unsigned-136be021783953a5bb74f7d1457e9506d4d36905, retained for 14 days
• downloaded installer: OPC App_0.1.1_x64-setup.exe, 10,944,534 bytes
• declared and independently calculated installer SHA-256 both equal 0d07e957072d600dc6576df7463a40fb5021758484f4e2a53aea3913ec1ef88e
• all executed PR checks passed; the fixed-ref release lifecycle check is intentionally skipped for a pull request