Specify a Windows installer built by the Linux CI

The tree is closer to Windows than a Linux-only project usually is:
every image library, the TLS stack and the inference engine are pure
Rust, and dr-plat already keeps the Linux-only code behind cfgs with a
loud fallback where none exists for another platform. What remains is
a short list above dr-plat — five XDG path lookups, an xdg-open, the
secret store's third implementation, the models' lookup beside the
executable — and none of it touches core, which is the NFR-PORT-3 test
this would be the first real run of.

docs/windows.md decides the GNU target over MSVC-via-xwin, Vulkan only
as on every other platform, a per-user NSIS installer that leaves the
library alone on uninstall, and a CI leg in the shape of the Android
one. It is explicit about what a runner with no Windows can verify —
that it links, is PE32+, starts under Wine and installs under Wine —
and what it cannot, which is everything involving a real GPU driver.
Three FR-PLAT-WIN requirements and a channel row record the decisions;
the ordering puts a first cross-compile on the developer machine before
any container exists, because the list of cfg gaps is a reading of the
source and the compiler's list will be longer.

docs/distribution.md

@@ -22,8 +22,9 @@ permission to a package rather than after.
 | Linux | AppImage | v1 channel, **recipe not yet written** (§5) | Oldest supported glibc, and no sandbox at all |
 | Android | F-Droid | v1 channel, not yet submitted | GPLv3-clean build, reproducible, no proprietary blobs |
 | Android | Play Store | **Not v1** (§6) | Would make ARCH §6.9 binding as policy rather than as engineering |
+| Windows | NSIS per-user installer, cross-built — [windows.md](windows.md) | **Specified, not built.** Not v1 | Known folders in place of XDG; no sandbox; unsigned until there is a certificate |
 
-Three of these five exist as recipes and two do not. That is stated rather than
+Three of these six exist as recipes and three do not. That is stated rather than
 smoothed over, because the value of writing the channels down is knowing which
 constraints are already being met and which are promises.
 
@@ -245,6 +246,8 @@ packaging/
   paris.tourolle.darkroom.metainfo.xml      AppStream, installed by every channel
   flatpak/
     paris.tourolle.darkroom.yml             the manifest, and where the permissions are argued
+  windows/
+    darkroom.nsi                            specified in windows.md §5; not yet written
 ```
 
 `packaging/` also accumulates built `.pkg.tar.zst` artefacts from local