fix(installer): Files Exclude is a child element, not an attribute

WiX 5.0.2 rejected Exclude="..." as an attribute on <Files> with
WIX0004 -- confirmed against the pinned compiler binary (5.0.2+aa65968c,
pulled from the local NuGet cache), not guessed. The correct form is a
child <Exclude Files="..."/> element, one per pattern.

Also drop the "**\obj\**" exclusion: WiX 5.0.2's harvester throws
(System.ArgumentException: Illegal characters in path, inside
HarvestFilesCommand.GetWildcardFiles) on any Exclude Files pattern with
two "**" segments -- reproduced locally against the real compiler. A
single-"**" trailing form only matches a root-level obj folder and
fires a permanent "missing directory" warning since BinDir never has
one; the real CI-built payload (304 files, inspected in a prior
session) contains zero "obj" path segments at any depth, so this
exclusion was a no-op to begin with.

Verified end-to-end, not just XML-well-formed: compiled the actual
Package.wxs with the actual pinned WiX 5.0.2 binary against this
checkout's real app/build/x64/Release output (307 files) using the
same Util/Firewall extensions the wixproj references. Exit 0, only the
pre-existing WIX1149 warning. The resulting MSI's File table has 303
entries (0 leaked .pdb, 0 leaked obj/) and carries
Microsoft.WindowsAppRuntime.dll, Microsoft.ui.xaml.dll, resources.pri,
a brand font, and App.xbf -- confirmed both by direct query and by
running app/tools/verify-msi-payload.ps1 against it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PT7KcWCPKfFwQUc7SM3oZY

Author: Ryanmello07

app/installer/Package.wxs

@@ -137,6 +137,11 @@
          tools/package-portable.ps1 zips as the portable build, so this
          payload and the zip's payload cannot drift apart.
 
+         Exclude is a CHILD element here (Exclude Files="..."), not an
+         attribute on <Files> — WiX 5.0.2 rejects Exclude="..." on Files
+         itself with WIX0004 (confirmed against the pinned 5.0.2 compiler
+         binary, not guessed).
+
          The five files above (AppExe/SdkDll/ResourcesPri/ServiceExe/
          WintunDll) keep their own hand-authored <Component> because they
          need behavior <Files> harvesting cannot express — the advertised
@@ -146,11 +151,39 @@
          SplitTunnelDriver is excluded for the same reason: it is
          conditioned on INSTALLDRIVER=1 and must not be unconditionally
          harvested when -IncludeDriver built the .sys into BinDir. Build
-         junk (.pdb/.lib/.exp/.ilk, any obj\ tree) is excluded to match
-         package-portable.ps1's own exclusions exactly. -->
+         junk (.pdb/.lib/.exp/.ilk) is excluded to match
+         package-portable.ps1's own exclusions.
+
+         package-portable.ps1 also defensively drops any path segment
+         literally named "obj" at any depth. That pattern is deliberately
+         NOT reproduced here: WiX 5.0.2's harvester crashes
+         (System.ArgumentException: Illegal characters in path, inside
+         HarvestFilesCommand.GetWildcardFiles) on an Exclude Files value
+         with two "**" segments, such as "...\**\obj\**" — confirmed
+         against the pinned compiler, not guessed. A single trailing form
+         ("...\obj\**") compiles but only matches an "obj" directory
+         directly under BinDir, and fires a permanent
+         "missing directory for harvesting" warning on every build where it
+         (correctly) does not exist — which is always: the real CI-built
+         payload (304 files, inspected directly from a prior successful
+         run) contains zero "obj" path segments at any depth, so this is a
+         belt-and-suspenders guard in the zip packager with nothing to
+         guard against here. If BinDir ever legitimately grows an obj\
+         subtree, add a targeted Exclude for that specific path rather than
+         reintroducing the double-"**" form. -->
     <ComponentGroup Id="RuntimeFiles" Directory="INSTALLFOLDER">
-      <Files Include="$(var.BinDir)\**"
-             Exclude="$(var.BinDir)\URnetwork.exe;$(var.BinDir)\URnetworkSdk.dll;$(var.BinDir)\resources.pri;$(var.BinDir)\urnetworkd.exe;$(var.BinDir)\wintun.dll;$(var.BinDir)\SplitTunnel.sys;$(var.BinDir)\**\*.pdb;$(var.BinDir)\**\*.lib;$(var.BinDir)\**\*.exp;$(var.BinDir)\**\*.ilk;$(var.BinDir)\**\obj\**" />
+      <Files Include="$(var.BinDir)\**">
+        <Exclude Files="$(var.BinDir)\URnetwork.exe" />
+        <Exclude Files="$(var.BinDir)\URnetworkSdk.dll" />
+        <Exclude Files="$(var.BinDir)\resources.pri" />
+        <Exclude Files="$(var.BinDir)\urnetworkd.exe" />
+        <Exclude Files="$(var.BinDir)\wintun.dll" />
+        <Exclude Files="$(var.BinDir)\SplitTunnel.sys" />
+        <Exclude Files="$(var.BinDir)\**\*.pdb" />
+        <Exclude Files="$(var.BinDir)\**\*.lib" />
+        <Exclude Files="$(var.BinDir)\**\*.exp" />
+        <Exclude Files="$(var.BinDir)\**\*.ilk" />
+      </Files>
     </ComponentGroup>
 
     <!-- urnetwork:// protocol handler (OAuth callbacks + deep links) -->