feat(desktop): Windows enterprise packages - MSI (SCCM) + AppX/MSIX (Intune) targets, contract test, runbook

[alexander-blackwell]

Closes #345. Core-side work for the enterprise add-on's Windows-packages item (add-on #75, PI-4 / ADR-A009 epic). Completes the enterprise platform set next to Linux deb/rpm (#147) and macOS pkg + cask (#141).

Layer 1/2 of stack #349 (#348 stacks on this).

Why now

Both foundations this work was blocked on have landed: the air-gap build profile (ADR-0225: vendored omp, bundled SHA-pinned relocatable CPython, CI air-gap smoke that fails any non-self-contained installer) and the managed-config update channel (add-on #74, ADR-A009). Current build.win produces only nsis + portable: nothing SCCM or Intune can consume for managed, in-place-upgradable deployment. Windows was the last platform without enterprise packages.

What changed

1. desktop/package.json: two new win targets (x64)

• msi (SCCM): perMachine: true (SCCM installs in SYSTEM context to Program Files), oneClick: false, runAfterFinish: false (silent SYSTEM installs must not launch the app), pinned upgradeCode: 2568ebca-6784-4546-9463-9765440afaf3, warningsAsErrors: false (the harvested app tree is large; WiX warnings must not brick the build), versioned artifact LucidAgent-\${version}-x64.msi.
• appx (Intune LOB / MSIX family): identity TechLead187.LucidAgent, publisher CN=TechLead 187 LLC, applicationId: LucidAgent, versioned artifact name.

The UpgradeCode is the load-bearing decision: it is the identity Windows Installer uses to say "same product, upgrade in place". Change it and every managed fleet gets a second side-by-side install: duplicate shortcuts, orphaned versions, broken SCCM/Intune supersedence. It is pinned once, forever.

2. desktop/win_packaging.test.ts (new): the contract is enforced, not documented

Pins the exact UpgradeCode value (+ GUID shape), perMachine, runAfterFinish: false, the four-target set, AppX identity shapes (identityName charset/length, CN= publisher, applicationId rules), and versioned artifact names for both enterprise targets. Any silent drift in the data-loss-shaped config now fails make test and CI instead of shipping.

3. build-desktop.yml: artifacts wired through

*.msi / *.appx added to the run-artifact upload, the tag-release attach, and the rolling latest release lists; windows matrix label + header comment updated. No new secrets: Authenticode rides the existing WIN_CSC_LINK / WIN_CSC_KEY_PASSWORD seam (exported only when present, exactly as before); without them the artifacts build unsigned, same posture as the macOS pkg work in #141. The ADR-0225 air-gap smoke still runs on the same job before any upload, so the new installers cannot ship non-self-contained.

4. docs/WINDOWS-ENTERPRISE-DEPLOYMENT.md (new): the runbook

Mirrors the Linux/macOS runbooks: package facts, why upgrades never touch %APPDATA%\LucidAgentIDE (nothing user-editable ships in either package; MSI major upgrades remove only owned components; admin policy arrives via ADR-A010, not the package), local + CI build, signing (CI seam or signtool post-build with timestamping; MSIX must be signed with a device-trusted org cert whose subject equals the package publisher, Intune refuses unsigned LOB MSIX), SCCM application setup (ProductCode detection, msiexec install/uninstall, system context), Intune Win32 path (.intunewin wrap, supersedence as update), Intune MSIX LOB path (cert trust deployment), the NSIS-per-user to MSI-per-machine migration note, an AppContainer/MSIX composition note (ADR-A020 containment is independent of install tech), and the runner-bound validation checklist.

What this deliberately does not do

• No arm64 (no other platform publishes it yet).
• No signing certs or secrets in-repo; the runbook covers both org paths.
• Fleet validation (install, N to N+1 in-place upgrade, %APPDATA% preservation, signed-MSIX sideload) is runner-bound, same as build(desktop): Linux rpm (YUM/DNF) + deb (APT) packages + internal-mirror runbook #147/macOS enterprise packaging: .pkg + Homebrew cask + MDM runbook #141; the checklist is runbook 6.

Evidence

• make test: 2630 pass / 0 fail (+4 new contract tests) + scanner-sidecar pytest green.
• desktop/package.json parses; targets verified by the new test.
• Zero em dashes in the new files (AGENTS.md writing rule).
• Air-gap smoke untouched and still gating.