[devigned]

Summary

• Publish exactly vx-bridge-installer-windows-amd64-vX.Y.Z.exe and its .exe.sha256. GitHub's automatic source archives remain; no separate MSI, bridge ZIP, installer ZIP, metadata or notices assets are uploaded.
• Wrap the existing hash-bound native Setup/MSI pair in a thin native EXE, avoiding the circular Setup/MSI hash dependency. Preserve Windows Installer servicing, receipt/PackageCode/exact-source checks, per-user admission, Pending denial, guarded Quit and the passive maintenance cache.
• Verify all embedded bytes before private, per-invocation staging; retain file pins through the inner Setup lifetime; use identity-checked nonrecursive cleanup. Provide explicit /extract for notice inspection and original-media recovery without installation.
• Carry the original authoritative application ZIP internally for static verification, not as a separate user download. Update packaging, native-input provenance, publication allowlists, checksum tests, help, user guides and technical documentation.

Validation

• make ci passes with the pinned Go toolchain; Windows amd64 cross-vet passes.
• The complete native build passes from clean signed source with the exact pinned Ubuntu/MinGW toolchain. The outer EXE imports only Windows system DLLs.
• Packaging/publication fixtures check the actual exact two-file allowlist, version-only public filenames, canonical checksum contents and rejection of extra assets, symlinks, malformed bundles and source/version mismatches.
• The native C layout parser is exercised against emitted bundle bytes; changed documentation links/anchors and shell syntax resolve.
• Hosted CI passes, including real Windows MSI authoring, emitted-table/CAB checks, native tests and self-contained packaging. No installer or product executable was run.
• Independently downloaded immutable Windows artifact 13338333418, verified its original container digest, confirmed exactly EXE/checksum in release-artifacts, and re-ran make verify-installer on the real 17,992,605-byte EXE. Its ten embedded entries, exact merge-source revision, unchanged authored Setup/MSI hashes and generated PackageCode agree.

Initial attempts encountered unchanged timing fixtures in the frozen probe unit tests and bridge recovery tests. A partial Windows retry correctly refused inputs from a different run attempt. The signed empty second commit triggered fresh full inputs without weakening provenance; only the independent portable job needed a further retry. No unrelated tests or qualification guards were changed.

Boundaries

Existing v0.1.0 tags/assets and their historical release notes are unchanged. This PR changes future releases only; it creates no tag or release. Ordinary application startup never invokes MSI. Compatibility/storage/pipe/product-family identities and source-first shutdown protections remain unchanged. The parked private-only qualification guards remain intact; only their source-inventory counts change with the new native sources.

No Windows extraction/interactive servicing, client-PC, sign-in or live-equipment qualification is claimed. No Authenticode signing is added; both commits are cryptographically signed and verified, but Git signatures do not sign Windows binaries.