Ship tested Windows MSI and WinGet flow

[Vixman]

Summary

• fix Windows terminal, SSH and SSO compatibility
• embed the executable payload in the MSI
• test Windows MSI installation and uninstall in CI
• verify Authenticode signatures during release
• prepare first WinGet submission and release runbook

Test plan

• Windows unit tests pass
• Windows MSI smoke passes
• Existing Python tests pass
• Signing configuration reviewed by Ops

---

Note

Medium Risk
Touches Windows installer layout, release signing gates, and SSO completion behavior (narrower auto-complete path), plus new required CI checks that can block merges if Windows jobs fail.

Overview
Windows packaging and distribution get a full release path: the WiX MSI is x64, embeds the cabinet payload, uses Wildfoundry Ltd as publisher, and CI builds, silently installs, exercises the binary, checks machine PATH, and uninstalls instead of only parsing the .wxs. Branch rules and docs now require Windows unit tests and Windows MSI smoke; release adds post-sign Authenticode checks on the .exe and .msi.

WinGet: README steers users to winget install; prepare_manifest.py and an expanded bootstrap workflow build manifests from a published release tag (URL, SHA-256, date); update-winget pins winget-releaser to a fixed commit. New docs/windows-release.md documents signing, smoke, and first-submission constraints (e.g. skip broken v0.1.6 MSI).

CLI on Windows: remote_access uses optional POSIX terminals and msvcrt for console input; SSH tunneling uses os.devnull for host-key skipping. SSO auto-complete now only applies tokens from the local callback listener—removed code-exchange and GET /api/auth/sso/complete/ polling—so manual paste must already contain tokens.

^{Reviewed by Cursor Bugbot for commit 41b51a1. Configure here.}

[cursor]

Stale comment

Left a non-blocking comment: Cursor Bugbot stayed pending past the 8-minute wait, so this PR is not approved. Human review is needed; a reviewer was assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 41b51a1. Configure here.}

[cursor]

Left a non-blocking comment: Cursor Bugbot reported unresolved findings that need human review, so this PR is not approved. A reviewer is already assigned. Cursor Security Agent was not running after the first check poll.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Approved. Present automated-review checks were clean after skipping Cursor Security Agent (not running after the first poll), and prior Cursor Bugbot findings are resolved. No reviewers were assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Approved. Cursor Bugbot and Cursor Security Agent were not running after the first check poll, and prior Bugbot findings are resolved. No reviewers were assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}