feat(packaging): a Light installer target with no bundled node runtime

MeshBay Light ships the Electron client + UI only -- no PyInstaller node
freeze, no ffmpeg, no service install/autostart. Two standalone
electron-builder configs (Full via package.json's build field, Light via
electron-builder.light.yml passed with --config, which reads only that
file -- confirmed against app-builder-lib's own config loader) rather than
one config branching on a flag.

build-win-common.ps1 holds the steps both orchestrators share (Node check,
npm ci, Electron bump, sync-ui) so build-win.ps1 (Full) and the new
build-win-light.ps1 cannot drift apart; build-win.ps1 is refactored to
dot-source it with no behavior change (rebuilt and diffed byte-identical
output).

installer-light.nsh keeps the one thing Light still needs -- an
unconditional firewall rule, since the client listens too -- and none of
the service-mode/autostart machinery installer.nsh carries, which has
nothing to gate without a bundled node.

dist-light/ (Light's own electron-builder output dir) gets its own
.gitignore line since the bare dist/ rule does not match it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

1 files changed, 13 insertions, 30 deletions

diff --git a/packaging/win/build-win.ps1 b/packaging/win/build-win.ps1
index 0a30ad5..ea54c6f 100644
--- a/packaging/win/build-win.ps1
+++ b/packaging/win/build-win.ps1
@@ -9,13 +9,18 @@
     meshbay-node daemon. No hub -- a desktop machine installs client + node
     (+ common, which is inside the node runtime).
 
+    This is the "Full" target. See build-win-light.ps1 for "Light" (client +
+    UI only, no bundled node) -- steps 1-4 below live in build-win-common.ps1,
+    shared by both, so they cannot drift apart.
+
     Steps:
       1. Node >= 22 check
       2. npm ci  (+ approve Electron's install script, download Chromium)
       3. bump Electron to the latest release  (Chromium CVE policy -- see
          build-client.sh; skip with -NoElectronBump)
       4. npm run sync-ui        (copy the interface from the hub package)
-      5. build-node-runtime.ps1 (PyInstaller freeze of the daemon)
+      5. build-node-runtime.ps1 (PyInstaller freeze of the daemon) -- Light
+         skips this step entirely, which is the whole difference
       6. electron-builder --win nsis
 
 .PARAMETER SkipFfmpeg
@@ -44,45 +49,23 @@ $WinDir = $PSScriptRoot
 $Repo   = (Resolve-Path (Join-Path $WinDir "..\..")).Path
 $Client = Join-Path $Repo "packages\meshbay-client"
 
-function Step($msg) { Write-Host "==> $msg" -ForegroundColor Cyan }
+. (Join-Path $WinDir "build-win-common.ps1")
 
 # --- 1. Node -------------------------------------------------------------
-if (-not (Get-Command node -ErrorAction SilentlyContinue)) {
-    throw "Node.js not found. Install Node 22 or newer from nodejs.org."
-}
-$nodeMajor = [int](& node -e "process.stdout.write(String(process.versions.node.split('.')[0]))")
-if ($nodeMajor -lt 22) { throw "Node $nodeMajor is too old -- need 22 or newer for Electron" }
-Step "Node $(& node --version)"
+Assert-NodeVersion
 
 Push-Location $Client
 try {
     # --- 2. deps ------------------------------------------------------
-    Step "npm ci"
-    & npm ci --ignore-scripts
-    if ($LASTEXITCODE -ne 0) { throw "npm ci failed" }
+    Invoke-NpmCi
 
     # --- 3. Electron: build against the latest release --------------
-    # Writes package.json + package-lock.json, so the build leaves the repo
-    # dirty on purpose -- commit the new pin.
-    if (-not $NoElectronBump) {
-        Step "checking for a newer Electron"
-        $bumped = & node (Join-Path $WinDir "bump-electron.mjs")
-        if ($LASTEXITCODE -ne 0) { throw "electron bump failed" }
-        if ($bumped) {
-            Write-Host "    Electron -> $bumped  (package.json + lock updated, commit them)" -ForegroundColor Yellow
-        } else {
-            Write-Host "    Electron is already current"
-        }
-    }
-
-    Step "downloading Electron's Chromium"
-    & npm approve-scripts electron 2>$null
-    & node node_modules/electron/install.js
+    # Writes package.json + package-lock.json when it bumps something, so the
+    # build leaves the repo dirty on purpose -- commit the new pin.
+    Invoke-ElectronBump -NoElectronBump:$NoElectronBump -WinDir $WinDir
 
     # --- 4. UI -----------------------------------------------------
-    Step "npm run sync-ui"
-    & npm run sync-ui
-    if ($LASTEXITCODE -ne 0) { throw "sync-ui failed" }
+    Invoke-SyncUi
 
     # --- 5. node runtime ---------------------------------------
     $rtExe = Join-Path $Client "node-runtime\meshbay-node.exe"