M14: Windows 7 build: patch windows-link for that build only, manual CI

- Drop the workspace [patch.crates-io] and restore windows-link's crates.io
  source and checksum in Cargo.lock, so every normal build keeps the
  checksum-verified crate. windows7.ps1 now applies vendor/windows-link with
  --config, checks that only windows-link's lock entry moved, builds and tests
  with --locked, checks the patched crate is the one in use, and restores
  Cargo.lock afterwards.
- windows7.yml runs on demand and weekly instead of on every PR, pins every
  action by commit SHA, and leaves the dependency check and host tests to the
  script (-Test) so the Cargo arguments live in one place.
- ROADMAP, README, NOTICE and docs: experimental, unsupported, not verified by
  maintainers.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

.github/workflows/windows7.yml

@@ -1,52 +1,43 @@
+# Experimental, unsupported Windows 7 SP1 x64 portable build (docs/windows7.md). It runs by hand and
+# weekly, so ordinary PRs never wait on it, and the weekly run shows when a dependency update starts
+# importing a post-Windows-7 API. packaging/windows/windows7.ps1 does the work: it is the only build
+# that uses the patched vendor/windows-link. A modern Windows runner proves compilation and host
+# smoke tests only: run the checklist in docs/windows7.md on actual Windows 7 before claiming support.
 name: Windows 7 x64 compatibility
+
 on:
+  schedule:
+    - cron: "23 5 * * 1" # weekly
   workflow_dispatch:
-  pull_request:
-    paths:
-      - '**/*.rs'
-      - '**/Cargo.toml'
-      - Cargo.lock
-      - vendor/windows-link/**
-      - packaging/windows/windows7.ps1
-      - .github/workflows/windows7.yml
+
 permissions:
   contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+  CARGO_INCREMENTAL: 0
+
 jobs:
   build:
     runs-on: windows-2022
     timeout-minutes: 90
     steps:
-      - uses: actions/checkout@v4
-      - uses: ilammy/msvc-dev-cmd@v1
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
         with:
           arch: x64
-      - uses: dtolnay/rust-toolchain@master
+      - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # master
         with:
           toolchain: nightly-2026-10-01
           components: rust-src
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           key: windows7-x64
-      - name: Check that modern Windows backends are excluded
+      - name: Build, check and test the portable package
         shell: pwsh
-        run: |
-          $tree = cargo +nightly-2026-10-01 tree --locked -p vectorcraft --target x86_64-win7-windows-msvc --no-default-features --features windows7 -e normal --prefix none
-          if ($LASTEXITCODE -ne 0) { throw 'dependency inspection failed' }
-          if ($tree -match '^(wgpu|wgpu-core|wgpu-hal|accesskit_windows) v') { throw 'unsupported Windows backend in compatibility build' }
-      - name: Build portable package
-        shell: pwsh
-        run: ./packaging/windows/windows7.ps1
-      - name: Test Windows code paths on the build host
-        shell: pwsh
-        env:
-          CARGO_TARGET_X86_64_WIN7_WINDOWS_MSVC_RUSTFLAGS: '-C target-feature=+crt-static'
-        run: |
-          cargo +nightly-2026-10-01 test -Z build-std=std,panic_unwind,test --locked --target x86_64-win7-windows-msvc --no-default-features --features vectorcraft/windows7 -p vectorcraft -p vectorcraft-cli
-          if ($LASTEXITCODE -ne 0) { throw 'tests failed' }
-      - uses: actions/upload-artifact@v4
+        run: ./packaging/windows/windows7.ps1 -Test
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: vectorcraft-windows7-x64-portable
           path: dist/release/vectorcraft-windows7-x64-portable.zip
           if-no-files-found: error
-# A modern Windows runner proves compilation and host smoke tests only.
-# Run the checklist in docs/windows7.md on actual Windows 7 before claiming support.