Loopky v0.12.0

loopky runs on Windows

This release is mostly one thing: the CLI's third host. loopky-windows-x86-64.exe is a single
binary like the other two rows, installed by its own PowerShell installer:

irm https://github.com/jvsena42/loopky/releases/latest/download/install.ps1 | iex

It lands in %LOCALAPPDATA%\Programs\loopky — Local, not Roaming, so a 66 MB binary is not
replicated to a domain server at logoff — verifies the SHA-256 digest, and tells you about
PATH rather than editing it. It refuses before downloading if the Visual C++ redistributable
is missing, because loopky.exe cannot start without it and installing something unrunnable
while reporting success is worse than refusing. The session is kept in a DPAPI blob rather than
in plaintext, and loopky update replaces a running .exe by renaming it aside.

The three rows fail differently, which is why all three are now built and their installers
exercised on every PR.

Added

• cli: The Windows row — the binary, the DLL, the third host and an unfiltered suite
• cli: Publish the Windows binary, and verify the installer that fetches it
• cli: Keep the Windows session in a DPAPI blob, not in plaintext
• cli: Keep Windows state out of the roaming profile
• cli: Update a running loopky.exe by renaming it aside
• cli: Name the near miss when a verb is unknown
• onboarding: Say when the approval wait runs long, with a way out
• auth: Bind the Ring deeplink to the grant flow

Fixed

Windows

• cli: Report a missing VC++ runtime by its exit status, which is the only evidence there is
• cli: Point Windows at a redistributable new enough to run the binary
• cli: Accept the VC++ runtime dependency and pin the whole import set
• cli: Stop escaping the IncludeResources patterns, which broke the Windows image
• cli: Stop the Windows installer from killing the shell it runs in
• cli: Refuse to self-update a running .exe by name, not as a permissions fault
• cli: Keep the DPAPI input buffers reachable across the native call
• cli: Keep stdout for the result on Windows, where the old swap only claimed to
• cli: Name the current user in the DACL, not the file's owner
• cli: Make "owner-only" true on a host that spells it with an ACL

Everything else

• cli: Stop the worst-case update message contradicting itself
• cli: Report the file when the secure item is answering and empty
• cli: Carry the injected environment into the platform branch, and correct two claims
• cli: Accept a grant credential as LOOPKY_SESSION
• import: Correct the claims about which characters break the URL, and why
• import: Open a spooled collection by URI, not by path
• onboarding: Keep an approval that arrives late instead of timing it out
• Show the deck's cover emoji on Today, not the title's initial
• Hold the splash until onboarding hands off, on both platforms

Full changelog: v0.11.3...v0.12.0