Windows: driver status banner, OTA never reboots unprompted, no UAC prompt at plug time

[emir-hasanbegovic]

Summary

Three things on this branch:

1. Windows dashboard driver banner: for ViGEmBus and HIDMaestro, whether each is installed, the installed version against the version this build bundles, and whether ViGEmBus is waiting on a restart. Green strip when current; amber/red with the fix as the action.
2. OTA upgrade never reboots unprompted: the in-app updater ran the installer /VERYSILENT without /NORESTART; a bundled ViGEmBus upgrade over an older driver can exit 3010, which a very-silent Inno run answers by rebooting the PC. Fixed, with driver failures logged instead of raised as modals under /OTA.
3. No UAC prompt when a HIDMaestro controller connects: setup registers satellite-hm-helper.exe as the LocalSystem service SatelliteHmBroker ("Satellite Controller Broker"). Satellite reaches it over \\.\pipe\satellite-hm-broker instead of spawning an elevated helper, so the first plug of a session no longer needs someone at the PC. The runas path remains as the fallback.

Broker service design

• Demand-start; started by the SCM named-pipe trigger (sc triggerinfo start/namedpipe/...) or by satellite itself (setup's SDDL grants interactive users SERVICE_START); exits after five idle minutes.
• Pipe DACL: SYSTEM + Administrators full, Interactive logons read/write (no network logon can reach it). Each connection is admitted only if the client PID is the installed satellite.exe beside the helper (QueryFullProcessImageName, run as SYSTEM) in an interactive session.
• Satellite accepts the pipe only when GetNamedPipeServerProcessId equals the registered service's PID from QueryServiceStatusEx, so a squatted pipe name is refused, and it falls back to the spawned helper.
• One client session at a time (the SDK's orphan sweep is machine-global); a second gets busy and falls back.
• Helper gains service (advapi32 dispatcher, no new NuGet dependency) and broker (console) modes; hello answers "broker":true over the service.
• Installer: PrepareToInstall stops the service before files are replaced; ssPostInstall creates/reconfigures it (sc create|config, description, sdset, triggerinfo, failure) when the hidmaestro component is selected and /HIDMAESTRO=skip is not passed, otherwise removes it; uninstall removes it before files go.

API (additive, /api/backend/status + /api/server/capabilities)

Per backends[] entry on Windows: driverVersion now filled (ViGEmBus.sys file version; HIDMaestro driver-store INF DriverVer, 1.7.0 embeds 1.4.7.12), plus bundledVersion, versionState (current/outdated/newer/unknown) and restartPending. Pins in src/platform/windows/driver_pins.h, checked against installer.iss by version-consistency.yml.

Tests

• New pure suite test_driver_inf; test_semver dotted compare; test_backend_registry version-state + JSON fields; test_routes_admin field presence. All local MinGW suites pass; clang-format 22.1.4 clean.
• Broker, verified unelevated: console broker mode accepts repeated connections, authorizes by client image path (a PowerShell client is refused with client not satellite.exe), and re-creates its pipe instance (a DACL bug there was found and fixed).
• Broker, needs an elevated shell: scripts/test-broker-service.ps1 registers the service against the built helper, asserts it hosts in session 0, answers on the pipe, restarts from the named-pipe trigger after a stop, and carries the SERVICE_START grant, then removes it. Not run in this session (no elevation available); please run it once before merging.
• scripts/test-installer-roundtrip.ps1 additionally asserts no service exists under /HIDMAESTRO=skip and after uninstall.

Docs

CHANGELOG 2.0.0 (two paragraphs), README ("Upgrading", broker paragraph, switch table), docs/architecture.md (Elevation story), docs/contract.md (new fields), SECURITY.md (broker boundary in scope), redist/README.md (pin-bump recipe).