feat(packaging): a Light installer target with no bundled node runtime

MeshBay Light ships the Electron client + UI only -- no PyInstaller node
freeze, no ffmpeg, no service install/autostart. Two standalone
electron-builder configs (Full via package.json's build field, Light via
electron-builder.light.yml passed with --config, which reads only that
file -- confirmed against app-builder-lib's own config loader) rather than
one config branching on a flag.

build-win-common.ps1 holds the steps both orchestrators share (Node check,
npm ci, Electron bump, sync-ui) so build-win.ps1 (Full) and the new
build-win-light.ps1 cannot drift apart; build-win.ps1 is refactored to
dot-source it with no behavior change (rebuilt and diffed byte-identical
output).

installer-light.nsh keeps the one thing Light still needs -- an
unconditional firewall rule, since the client listens too -- and none of
the service-mode/autostart machinery installer.nsh carries, which has
nothing to gate without a bundled node.

dist-light/ (Light's own electron-builder output dir) gets its own
.gitignore line since the bare dist/ rule does not match it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2 files changed, 69 insertions, 1 deletions

diff --git a/packages/meshbay-client/build/installer-light.nsh b/packages/meshbay-client/build/installer-light.nsh
new file mode 100644
index 0000000..86e41ba
--- /dev/null
+++ b/packages/meshbay-client/build/installer-light.nsh
@@ -0,0 +1,67 @@
+; electron-builder NSIS customisation for the "Light" target
+; (packaging/win/electron-builder.light.yml's nsis.include).
+;
+; Deliberately much smaller than build/installer.nsh (Full's): there is no
+; bundled node, so there is nothing to autostart, no PATH entry to add, no
+; process to stop before overwriting a file, and no boot-time Scheduled Task.
+; The only thing this installer does, all conditional on interactive setup
+; (never ${Silent}): set up the Windows Firewall rules Light still needs --
+; the client's own WebRTC ICE rule and the two LAN-casting rules (see
+; packaging/win/firewall.ps1's own header for why the *client*, not just a
+; node, needs an inbound allow). One elevation, no radio page -- there is
+; nothing to choose, so unlike Full's installer.nsh there is no mode
+; question at all.
+;
+; Per-user only, same reasoning as Full: the keystore and the DPAPI-protected
+; hub device key are bound to the signed-in account (MESHBAY_DESIGN.md
+; 11.2 / 7.5), and build.win's nsis config forbids elevation at install time.
+;
+; MUST NOT touch anything a co-installed Full client owns. Full and Light can
+; be installed side by side (distinct appId/productName/install dir), and it
+; is entirely plausible for a machine to have both -- Light's installer must
+; be a no-op with respect to a Full install's node process, its per-user
+; Startup entry, its Scheduled Task, and the "MeshBay Node" firewall rule.
+; Concretely: this file never stops a process by image name, never touches
+; the per-user PATH registry value, never references either of Full's two
+; service scripts, and never removes a startup shortcut of its own --
+; test_packaging_win.py pins that absence.
+
+!include "WinMessages.nsh"
+!include "LogicLib.nsh"
+
+!define MB_PWSH "$SYSDIR\WindowsPowerShell\v1.0\powershell.exe"
+
+; ── force per-user, skip the all-users / current-user page ──────────────────
+; Same as Full's installer.nsh -- see that file's own comment for why.
+!macro customInstallMode
+  StrCpy $isForceCurrentInstall "1"
+!macroend
+
+!macro customInstall
+  ${IfNot} ${Silent}
+    ; Unelevated first: Get-NetFirewallRule needs no admin, only New/Remove
+    ; do, so a repeat/repair install that already has the rules in place
+    ; raises no UAC prompt.
+    nsExec::Exec '"${MB_PWSH}" -NoProfile -ExecutionPolicy Bypass -File "$INSTDIR\resources\firewall.ps1" check'
+    Pop $R0                       ; 0 = every rule already present
+    ${If} $R0 != 0
+      ExecShellWait "runas" "${MB_PWSH}" \
+        '-NoProfile -ExecutionPolicy Bypass -File "$INSTDIR\resources\firewall.ps1" add' \
+        SW_HIDE
+    ${EndIf}
+  ${EndIf}
+!macroend
+
+!macro customUnInstall
+  ; Opt-in, default No -- a stale allow-rule is inert, so this should not
+  ; nag. A silent uninstall skips it entirely (no UAC prompt of its own).
+  ${IfNot} ${Silent}
+    MessageBox MB_YESNO|MB_ICONQUESTION \
+      "Remove MeshBay Light's Windows Firewall rules? This needs one administrator confirmation. They are harmless if left." \
+      /SD IDNO IDNO mb_keep_firewall
+      ExecShellWait "runas" "${MB_PWSH}" \
+        '-NoProfile -ExecutionPolicy Bypass -File "$INSTDIR\resources\firewall.ps1" remove' \
+        SW_HIDE
+    mb_keep_firewall:
+  ${EndIf}
+!macroend
diff --git a/packages/meshbay-client/package.json b/packages/meshbay-client/package.json
index e88b2f0..614e6d6 100644
--- a/packages/meshbay-client/package.json
+++ b/packages/meshbay-client/package.json
@@ -11,7 +11,8 @@
     "start": "electron .",
     "sync-ui": "node scripts/sync-ui.js",
     "dist": "bash ../../packaging/build/build-client.sh",
-    "dist:win": "powershell -NoProfile -ExecutionPolicy Bypass -File ../../packaging/win/build-win.ps1"
+    "dist:win": "powershell -NoProfile -ExecutionPolicy Bypass -File ../../packaging/win/build-win.ps1",
+    "dist:win:light": "powershell -NoProfile -ExecutionPolicy Bypass -File ../../packaging/win/build-win-light.ps1"
   },
   "devDependencies": {
     "electron": "^44.2.0",