Package meshtasticd for Windows as an MSI (#11289)

* Package meshtasticd for Windows as an MSI

Adds a --service flag connecting meshtasticd to the Service Control
Manager, a WiX MSI installing it as an auto-start LocalSystem service with
config in %ProgramData%\Meshtastic, and a CI step attaching the MSI to
releases.

* Address review comments

Bind workflow expressions to env vars in run: bodies, and build the
service status per call with an atomic checkpoint.

* Fix service stop state and CI lint

Latch the stop under a mutex so a startup report cannot walk the state
back. Ignore the new workflows in semgrep and checkov, as main_matrix
already is.

* Drop the checkov ignore for the winget workflow

Resolve the newest release inside the job instead of taking
workflow_dispatch inputs, so CKV_GHA_7 no longer fires and checkov stays
active on the file.

* Carry the MSI architecture into the winget manifest

Parse it from the asset name instead of defaulting to x64, and fail on a
multi-arch release rather than validating one at random.

* Restore release/.gitignore

* Leave the main matrix alone

Release attachment moves to the matrix rework in #11151. The MSI is still
built and uploaded as a CI artifact.

---------

Co-authored-by: Austin <vidplace7@gmail.com>

.github/workflows/build_windows_bin.yml

@@ -141,3 +141,25 @@ jobs:
           overwrite: true
           path: |
             .pio/build/native-windows/meshtasticd.exe
+
+      - name: Install WiX
+        shell: pwsh
+        run: |
+          dotnet tool install --global wix --version 5.0.2
+          "$env:USERPROFILE\.dotnet\tools" | Out-File -FilePath $env:GITHUB_PATH -Append -Encoding utf8
+          & "$env:USERPROFILE\.dotnet\tools\wix.exe" extension add -g WixToolset.Util.wixext/5.0.2
+
+      - name: Build the MSI and winget manifests
+        shell: pwsh
+        run: ./bin/build-winget-package.ps1 -ReleaseTag "v$env:LONG_VERSION" -Validate
+        env:
+          LONG_VERSION: ${{ steps.version.outputs.long }}
+
+      - name: Store the MSI and winget manifests as an artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: meshtasticd-msi-${{ inputs.windows_ver }}-${{ steps.version.outputs.long }}
+          overwrite: true
+          path: |
+            release/winget/*.msi
+            release/winget/manifests/

.github/workflows/package_winget.yml

@@ -0,0 +1,62 @@
+name: Validate winget manifest
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  validate-winget:
+    runs-on: windows-2025
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Resolve the newest release and download its MSI
+        id: release
+        shell: pwsh
+        run: |
+          $tag = gh release list --limit 1 --json tagName --jq '.[0].tagName'
+          if (-not $tag) { throw 'No releases found.' }
+          New-Item -ItemType Directory -Force -Path release/download | Out-Null
+          gh release download $tag --pattern '*.msi' --dir release/download
+          $msis = @(Get-ChildItem release/download/*.msi)
+          if ($msis.Count -eq 0) { throw "Release $tag carries no MSI asset." }
+          if ($msis.Count -gt 1) { throw "Release $tag carries $($msis.Count) MSIs; this validates one architecture." }
+          $parsed = [regex]::Match($msis[0].Name, '^meshtasticd-([0-9][0-9A-Za-z.\-]*)-(x64|arm64)\.msi$')
+          if (-not $parsed.Success) { throw "Cannot parse version and architecture out of $($msis[0].Name)." }
+          "tag=$tag", "version=$($parsed.Groups[1].Value)", "arch=$($parsed.Groups[2].Value)", "msi=$($msis[0].FullName)" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Generate manifests for the published MSI
+        shell: pwsh
+        run: ./bin/build-winget-package.ps1 -MsiPath $env:MSI_PATH -Version $env:PKG_VERSION -Architecture $env:PKG_ARCH -ReleaseTag $env:RELEASE_TAG -Validate
+        env:
+          MSI_PATH: ${{ steps.release.outputs.msi }}
+          PKG_VERSION: ${{ steps.release.outputs.version }}
+          PKG_ARCH: ${{ steps.release.outputs.arch }}
+          RELEASE_TAG: ${{ steps.release.outputs.tag }}
+
+      - name: Verify the manifest URL resolves to the published asset
+        shell: pwsh
+        run: |
+          $installer = Get-ChildItem release/winget/manifests -Recurse -Filter '*.installer.yaml' | Select-Object -First 1
+          $url = (Select-String -Path $installer.FullName -Pattern 'InstallerUrl:\s*(\S+)').Matches[0].Groups[1].Value
+          $expected = (Select-String -Path $installer.FullName -Pattern 'InstallerSha256:\s*(\S+)').Matches[0].Groups[1].Value
+          Invoke-WebRequest -Uri $url -OutFile fetched.msi
+          $actual = (Get-FileHash fetched.msi -Algorithm SHA256).Hash
+          if ($actual -ne $expected) {
+            throw "InstallerUrl $url hashes to $actual, manifest claims $expected"
+          }
+          "URL and hash agree: $url"
+
+      - name: Upload the manifests as an artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: winget-manifests-${{ steps.release.outputs.version }}
+          overwrite: true
+          path: release/winget/manifests/