feat(packaging): a Light installer target with no bundled node runtime

MeshBay Light ships the Electron client + UI only -- no PyInstaller node
freeze, no ffmpeg, no service install/autostart. Two standalone
electron-builder configs (Full via package.json's build field, Light via
electron-builder.light.yml passed with --config, which reads only that
file -- confirmed against app-builder-lib's own config loader) rather than
one config branching on a flag.

build-win-common.ps1 holds the steps both orchestrators share (Node check,
npm ci, Electron bump, sync-ui) so build-win.ps1 (Full) and the new
build-win-light.ps1 cannot drift apart; build-win.ps1 is refactored to
dot-source it with no behavior change (rebuilt and diffed byte-identical
output).

installer-light.nsh keeps the one thing Light still needs -- an
unconditional firewall rule, since the client listens too -- and none of
the service-mode/autostart machinery installer.nsh carries, which has
nothing to gate without a bundled node.

dist-light/ (Light's own electron-builder output dir) gets its own
.gitignore line since the bare dist/ rule does not match it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

1 files changed, 54 insertions, 0 deletions

diff --git a/packaging/win/electron-builder.light.yml b/packaging/win/electron-builder.light.yml
new file mode 100644
index 0000000..155ffa6
--- /dev/null
+++ b/packaging/win/electron-builder.light.yml
@@ -0,0 +1,54 @@
+# Standalone electron-builder config for the "Light" Windows target: Electron
+# client + UI, no bundled node. Deliberately NOT layered onto package.json's
+# `build` field -- passed via `electron-builder --config <this file>`, which
+# reads ONLY this file (app-builder-lib/out/util/config/load.js's getConfig:
+# a given configPath replaces package.json's own "build", it does not merge
+# with it). That is what keeps Light's extraResources from ever accidentally
+# inheriting Full's frozen daemon and its two service scripts through some
+# array-merge surprise -- there is nothing to merge.
+#
+# Invoked from packages/meshbay-client (see build-win-light.ps1), so every
+# relative path below resolves the same way package.json's `build` field's
+# already do.
+#
+# See C:\Users\admin\devel\light-client.md for the evaluation this
+# implements.
+
+appId: org.meshbay.client.light
+productName: MeshBay Light
+
+directories:
+  # Full's own build lives in dist/ -- a separate output dir means the two
+  # targets never race on, or clobber, each other's files.
+  output: dist-light
+
+files:
+  - src/**
+  - ui/**
+
+win:
+  target: nsis
+  icon: build/icon.ico
+  artifactName: "MeshBay-Light-Setup-${version}.${ext}"
+  extraResources:
+    # firewall.ps1 needs no Light-specific fork: `add` already does
+    # `if (-not (Test-Path $r.Path)) { skip }` per rule, and the "MeshBay
+    # Node" rule's target -- the frozen daemon, inside the folder this
+    # config never ships -- simply is not here. One script, one source of
+    # truth; it just silently adds the 3 rules that apply (client WebRTC
+    # ICE + the 2 LAN-casting rules) and logs the node rule as skipped.
+    - from: ../../packaging/win/firewall.ps1
+      to: firewall.ps1
+
+nsis:
+  oneClick: false
+  perMachine: false
+  allowElevation: false
+  allowToChangeInstallationDirectory: true
+  createDesktopShortcut: true
+  createStartMenuShortcut: true
+  deleteAppDataOnUninstall: false
+  runAfterFinish: true
+  # Resolved against buildResourcesDir (build/), same as Full's implicit
+  # default of build/installer.nsh -- see platformPackager.js's getResource.
+  include: installer-light.nsh