Simplify the Windows build pipeline: replace Resource Hacker with go-winres

[TheZeekA]

Current state

.github/workflows/build-windows.yml builds the exe in a fairly fragile multi-tool chain:

1. go build (bare exe, no icon/manifest/version info)
2. Download and silently install Resource Hacker from a GitHub user-attachments URL
3. Five separate Resource Hacker invocations, each followed by a hardcoded Start-Sleep (30-60s) to work around it needing time between operations, to inject the icon (twice, for MAINICON and GLFW_ICON), the manifest, and compiled version info
4. Download and run upx to compress
5. Download and install WiX (pinned to v5, see the MSI installer PRs) to build the installer

Steps 2-3 alone add several minutes of Start-Sleep and depend on an external, unversioned zip download that isn't in our control.

Proposal

We already use go-winres for local dev builds (src/winres/winres.json) to auto-embed the icon via a committed .syso file — see src/README.md. go-winres can also embed the manifest and version info (RT_MANIFEST, RT_VERSION keys in the same winres.json), which could let CI drop the entire Resource Hacker step.

Rough plan:

• Extend src/winres/winres.json to include RT_MANIFEST (from dist/windows/manifest.xml) and RT_VERSION (replacing dist/windows/versioninfo.rc)
• Confirm the committed .syso files stay in sync (they're already regenerated via go-winres make per the existing docs)
• Remove the "Add icon, manifest, and version info" step and its Start-Sleep calls from build-windows.yml and pr-test-build-windows.yml
• Verify the resulting exe still has the correct icon, manifest, and version info (Explorer properties, sigcheck, etc.)
• Keep upx (unrelated concern, still useful for size) and the WiX MSI step as-is

Why this matters

We hit real fragility in this pipeline already this cycle (WiX v7's licensing EULA, an XML comment bug) — reducing the number of external, versioned-by-URL dependencies in the release pipeline reduces the surface area for that kind of breakage, and cuts several minutes of pure Start-Sleep wait time per build.

[TheZeekA]

Fixed on `testing` (commits `8aba2c7`, `c3793c5`):

• Manifest (`RT_MANIFEST`) and version info (`RT_VERSION`) moved into `src/winres/winres.json` alongside the existing icon entries; `dist/windows/versioninfo.rc` removed.
• CI's 5-step Resource Hacker chain (unversioned zip download + silent install + hardcoded `Start-Sleep` calls totaling 3.5+ min) replaced with a single `go tool go-winres patch` step, with `go-winres` pinned as a checksummed Go tool dependency instead of an unversioned URL.
• `upx` and the WiX MSI step are untouched, per the original proposal.

One implementation wrinkle worth noting: the manifest can't be folded into the compile-time `.syso` the way the icon is — this project cgo-links via mingw, whose CRT auto-links its own `default-manifest.o` into GUI executables, which conflicts with an embedded `RT_MANIFEST` at link time (`ld: .rsrc merge failure: multiple non-default manifests`). So the icon stays compile-time via `.syso` as before, and the manifest + version info get patched into the already-linked exe post-build via `go-winres patch` — same post-link approach Resource Hacker used, just one deterministic call instead of five.

Validated end-to-end on a real `windows-2025` runner via manual dispatch: run 30731838971, 5m16s (vs. ~8-9 min previously) with icon, `asInvoker` manifest, and version info all correctly embedded.

Not yet on `main` — will ship with the next testing→main release fold. Leaving this open until then.