feat(packaging): stamp the frozen node exe, document Windows networking

meshbay-node.spec now builds a VSVersionInfo (ProductName "MeshBay Node",
version read from the installed package so it tracks pyproject) and passes
it to EXE(version=...). The Windows Firewall prompt, Task Manager and the
file's Properties then show "MeshBay Node" instead of a bare exe name —
the prompt the operator has to answer on first run.

packaging/win/README.md gains a Networking section: the first-run firewall
prompt (allow Private AND Public — a VM adapter is Public), that a flat LAN
needs nothing else, what a routed/multi-subnet LAN additionally needs, the
libvirt-NAT caveat, and a pointer to the packaged Linux firewall profiles.

test_packaging_win.py covers the version resource.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

1 files changed, 13 insertions, 0 deletions

diff --git a/packages/meshbay-node/tests/test_packaging_win.py b/packages/meshbay-node/tests/test_packaging_win.py
index 8c8e272..77fb1e5 100644
--- a/packages/meshbay-node/tests/test_packaging_win.py
+++ b/packages/meshbay-node/tests/test_packaging_win.py
@@ -113,6 +113,19 @@ def test_the_spec_pulls_in_the_awkward_dependencies_whole():
             f"{pkg} dropped from the PyInstaller spec's collect list")
 
 
+def test_the_frozen_exe_carries_a_version_resource():
+    """
+    Without it the Windows Firewall prompt, Task Manager and Properties show a
+    bare "meshbay-node". The version is read from the installed package so it
+    tracks pyproject rather than being a second copy to update.
+    """
+    spec = (WIN / "meshbay-node.spec").read_text(encoding="utf-8")
+    assert "VSVersionInfo" in spec
+    assert "version=_version_info" in spec, "EXE() is not given the version resource"
+    assert 'StringStruct("ProductName", "MeshBay Node")' in spec
+    assert '_pkg_version("meshbay-node")' in spec, "version is hardcoded, not read from the package"
+
+
 # ── the artifact never gets committed ──────────────────────────────────────
 
 def test_the_node_runtime_output_is_gitignored():