Give the desktop executable a version flag and a Windows identity

Three things the Windows build showed the entry point was missing, and
that a Linux build never asks for.

`--version`, answered before the logger and the crash hook install: a
binary built on a machine that cannot run the application — the Linux
CI producing the Windows executable, checked under Wine — needs an
exit that proves it starts without opening a window or touching the
user's directories. It is the smoke test in docs/windows.md §6.

A GUI-subsystem executable in release, or Windows keeps a console
window open behind the application for the life of the process. Debug
builds keep the console, which is where their log goes.

A resource block, or Explorer, the Start Menu and the taskbar show the
generic executable icon and the Details tab is empty. build.rs wraps
the PNG every other platform uses into an .ico at build time — an ICO
entry may be a PNG, so the wrapper is a 22-byte header — and hands it
to winresource with the version cargo already knows. The crate is an
unconditional build-dependency because a cfg(windows) on one is
evaluated against the host, which here is Linux; the script itself
returns before touching it on any other target.

apps/darkroom-desktop/src/main.rs

@@ -1,12 +1,32 @@
 //! DarkRoom desktop entry point.
 //!
 //!   darkroom-desktop <file-or-directory>...
+//!   darkroom-desktop --version
+
+// TRACES: FR-PLAT-WIN-2
+// A GUI-subsystem executable, or Windows opens a console window behind the
+// application for the life of the process. Release only: the console is where
+// the log goes when there is no file, and a debug build is run from one.
+// `--version` still prints under this — stdout is simply not attached when
+// launched from Explorer, which is not where anyone asks for a version.
+#![cfg_attr(all(windows, not(debug_assertions)), windows_subsystem = "windows")]
 
 use std::path::PathBuf;
 
 use dr_plat::diagnostics::Installed;
 
 fn main() -> anyhow::Result<()> {
+    // TRACES: FR-PLAT-WIN-3
+    // Before the logger, the crash hook and everything else: this exists so a
+    // build made on a machine that cannot run the application — the Linux CI
+    // producing the Windows binary, checked under Wine — has an exit that
+    // proves the executable starts without opening a window or touching the
+    // user's directories (docs/windows.md §6).
+    if std::env::args().nth(1).as_deref() == Some("--version") {
+        println!("darkroom-desktop {}", env!("CARGO_PKG_VERSION"));
+        return Ok(());
+    }
+
     // Built rather than `init`ed, so the same logger can be handed to the
     // diagnostics tee: `env_logger` keeps writing to stderr exactly as before,
     // and every record it accepts is also appended to the on-disk log