feat(python-runtime): package the Windows x64 dsh executable

Add node24-win-x64 as the only supported Windows runtime target and publish it as a py3-none-win_amd64 wheel containing the conventional dsh and ripgrep .exe payload names. Keep Windows ARM64 rejected explicitly so Python cannot claim a carrier that CI and release automation do not build.

Teach the pkg builder to require a native x64 Windows host, validate both node-pty ConPTY addons, copy @vscode's win32 ripgrep executable, and recognize pkg's .exe output. Extend runtime resolution, wheel staging, payload validation, and the preset closure check so the Windows-specific PowerShell plugins and sidecars fail loud when omitted.

The sidecar resolver now maps a packaged main.exe to main-rg.exe; focused TypeScript and Python tests cover that name, the win_amd64 manifest, x64-only host selection, complete wheel payload, ConPTY inventory, and platform-conditioned plugin closure.

scripts/build-exe-for-python-sdk.spec.ts

@@ -0,0 +1,81 @@
+import { spawnSync } from 'node:child_process'
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join, resolve } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+
+const root = resolve(import.meta.dirname, '..')
+const script = resolve(root, 'scripts/build-exe-for-python-sdk.ts')
+const temporaryDirectories: string[] = []
+
+afterEach(() => {
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function run(env: NodeJS.ProcessEnv, ...args: string[]) {
+  return spawnSync(process.execPath, ['--import', 'tsx/esm', script, ...args], {
+    cwd: root,
+    encoding: 'utf8',
+    env: isolatedPnpmEnvironment(env),
+  })
+}
+
+describe('Python runtime executable builder CLI', () => {
+  it('runs pnpm through its JavaScript entrypoint without a command shell', () => {
+    const result = run(
+      { npm_execpath: 'C:\\tools\\pnpm.cjs' },
+      '--skip-build',
+      '--dry-run',
+      '--targets=node24-macos-arm64',
+    )
+
+    expect(result.status).toBe(0)
+    expect(result.stdout).toContain(`${process.execPath} C:\\tools\\pnpm.cjs run verify-runtime-closure`)
+    expect(result.stdout).toContain(`${process.execPath} C:\\tools\\pnpm.cjs --filter dsh-python-runtime-closure deploy`)
+    expect(result.stdout).toContain(`${process.execPath} C:\\tools\\pnpm.cjs dlx @yao-pkg/pkg@6.21.0`)
+    expect(result.stdout).not.toMatch(/pnpm\.cmd/i)
+  })
+
+  it('resolves the pnpm package behind a Windows command shim', () => {
+    const setup = mkdtempSync(join(tmpdir(), 'dsh-pnpm-home-'))
+    temporaryDirectories.push(setup)
+    const home = join(setup, 'node_modules', '.bin')
+    const entrypoint = join(setup, 'node_modules', 'pnpm', 'bin', 'pnpm.mjs')
+    mkdirSync(home, { recursive: true })
+    mkdirSync(dirname(entrypoint), { recursive: true })
+    writeFileSync(entrypoint, '')
+
+    const result = run(
+      { npm_execpath: 'C:\\tools\\pnpm.cmd', PNPM_HOME: home },
+      '--skip-build',
+      '--dry-run',
+      '--targets=node24-macos-arm64',
+    )
+
+    expect(result.status).toBe(0)
+    expect(result.stdout).toContain(`${process.execPath} ${entrypoint} run verify-runtime-closure`)
+    expect(result.stdout).not.toMatch(/pnpm\.cmd/i)
+  })
+
+  it('rejects a Windows arm64 product before any build step', () => {
+    const result = run(
+      { npm_execpath: 'C:\\tools\\pnpm.cjs' },
+      '--skip-build',
+      '--dry-run',
+      '--targets=node24-win-arm64',
+    )
+
+    expect(result.status).not.toBe(0)
+    expect(result.stderr).toContain('Windows supports x64 only')
+    expect(result.stdout).toBe('')
+  })
+})
+
+function isolatedPnpmEnvironment(overrides: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
+  const environment = Object.fromEntries(
+    Object.entries(process.env).filter(([key]) => !['npm_execpath', 'pnpm_home'].includes(key.toLowerCase())),
+  )
+  return { ...environment, ...overrides }
+}