Harden Windows packaging and diagnostics

[ami3go]

What changed

Windows packaging hardening from the v0.11.7 review, explicitly excluding code signing for now.

• add a dedicated Windows portable PyInstaller target with UPX disabled
• add a stable Windows onedir target and ZIP for long-running use
• embed Windows PE ProductName/FileVersion/ProductVersion/OriginalFilename metadata
• add a DroidWebDisplay Windows application icon
• keep verified bundled ADB/platform-tools and add packaged --adb-smoke execution
• strengthen Windows CI to build and test both package forms
• verify PE metadata and bundled ADB on Windows 2025
• run three service start/stop cycles for each Windows package form
• publish the stable Windows ZIP alongside the portable EXE in future releases
• improve ADB unauthorized/offline/OEM-driver guidance without changing control/clipboard architecture
• expose browser/WebCodecs/GPU context for Windows black-video troubleshooting
• classify the known Android 16 scrcpy AbstractMethodError + IDisplayWindowListener signature without replacing the protected scrcpy 4.1 adapter
• add Windows packaging/HIL documentation and regression coverage
• update setup-python to verified pinned v6 commit and update the supply-chain lock

Validation

DroidWebDisplay Release Gate #755 / run 32340805093 passed on head 3378d4906dfc5711b30027a7df211d83f04bc3db.

Green jobs:

• release
• windows-package-smoke
• linux-appimage-smoke

Windows 2025 validation specifically passed:

• portable EXE build
• stable onedir build
• PE metadata/version checks
• bundled adb.exe version execution
• portable desktop/CLI/ADB smoke
• onedir desktop/CLI/ADB smoke
• three repeated service start/stop cycles for portable
• three repeated service start/stop cycles for onedir
• stable onedir ZIP creation and artifact upload

The central gate also passed Python, protocol, web-client, static-client integrity and supply-chain tests.

No real-device Windows/Samsung HIL or Authenticode signing is claimed by this PR.