M14: Windows 7 build: patch windows-link for that build only, manual CI

- Drop the workspace [patch.crates-io] and restore windows-link's crates.io
  source and checksum in Cargo.lock, so every normal build keeps the
  checksum-verified crate. windows7.ps1 now applies vendor/windows-link with
  --config, checks that only windows-link's lock entry moved, builds and tests
  with --locked, checks the patched crate is the one in use, and restores
  Cargo.lock afterwards.
- windows7.yml runs on demand and weekly instead of on every PR, pins every
  action by commit SHA, and leaves the dependency check and host tests to the
  script (-Test) so the Cargo arguments live in one place.
- ROADMAP, README, NOTICE and docs: experimental, unsupported, not verified by
  maintainers.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packaging/windows/windows7.ps1

@@ -1,8 +1,10 @@
-<# Build on Windows 10/11 with the VS 2022 x64 C++ tools and Windows SDK.
-   From the repository root: powershell -File packaging/windows/windows7.ps1
+<# Experimental, unsupported Windows 7 SP1 x64 build (docs/windows7.md).
+   Build on Windows 10/11 with the VS 2022 x64 C++ tools and Windows SDK.
+   From the repository root: powershell -File packaging/windows/windows7.ps1 [-Test]
    The resulting portable ZIP targets Windows 7 SP1 x64 with an OpenGL 3.3 driver.
-   The compiler runs on the build host, not on Windows 7. #>
-param([string] $Toolchain = 'nightly-2026-10-01')
+   The compiler runs on the build host, not on Windows 7. -Test also runs the app and CLI tests
+   on the build host. #>
+param([string] $Toolchain = 'nightly-2026-10-01', [switch] $Test)
 $ErrorActionPreference = 'Stop'
 $Root = (Resolve-Path (Join-Path $PSScriptRoot '..\..')).Path
 $Target = 'x86_64-win7-windows-msvc'
@@ -10,19 +12,38 @@ function Invoke-Checked([scriptblock] $Command) {
   & $Command
   if ($LASTEXITCODE -ne 0) { throw "Command failed with exit code $LASTEXITCODE" }
 }
+# Cargo.lock without windows-link's registry source and checksum lines (and with LF line endings),
+# so the lock files with and without the patch below compare equal.
+function Get-LockWithoutWindowsLinkSource([string] $Text) {
+  ($Text -replace "`r`n", "`n") -replace '(?m)^(name = "windows-link"\nversion = "[^"]*"\n)source = "[^"]*"\nchecksum = "[^"]*"\n', '$1'
+}
 Push-Location $Root
 $FlagName = 'CARGO_TARGET_X86_64_WIN7_WINDOWS_MSVC_RUSTFLAGS'
 $OldFlags = [Environment]::GetEnvironmentVariable($FlagName)
 $OldWinres = $env:VECTORCRAFT_REQUIRE_WINRES
+$Lock = Join-Path $Root 'Cargo.lock'
+$LockBytes = [IO.File]::ReadAllBytes($Lock)
 try {
   Invoke-Checked { rustup toolchain install $Toolchain --profile minimal --component rust-src }
+  # windows-sys imports CoTaskMemFree from combase.dll, which Windows 7 lacks. Only this build uses
+  # the patched copy in vendor/windows-link (see its VECTORCRAFT-PATCH.md); every other build keeps
+  # the crates.io crate. Cargo records the patch in Cargo.lock, so resolve once, check that nothing
+  # but windows-link's source moved, then build --locked. The finally block restores Cargo.lock.
+  $Patch = @('--config', "patch.crates-io.windows-link.path='vendor/windows-link'")
+  Invoke-Checked { cargo "+$Toolchain" metadata --format-version 1 @Patch | Out-Null }
+  $Before = Get-LockWithoutWindowsLinkSource ([Text.Encoding]::UTF8.GetString($LockBytes))
+  $After = Get-LockWithoutWindowsLinkSource ([IO.File]::ReadAllText($Lock))
+  if ($Before -cne $After) { throw 'Cargo.lock is out of date: applying the windows-link patch changed other entries' }
+  $CargoArgs = @('--locked') + $Patch + @('--target', $Target, '--no-default-features', '--features', 'vectorcraft/windows7')
+  $Tree = cargo "+$Toolchain" tree @CargoArgs -p vectorcraft -e normal --prefix none
+  if ($LASTEXITCODE -ne 0) { throw 'dependency inspection failed' }
+  if ($Tree -match '^(wgpu|wgpu-core|wgpu-hal|accesskit_windows) v') { throw 'unsupported Windows backend in compatibility build' }
+  if (-not ($Tree -match '^windows-link v[^ ]+ \(.*vendor[\\/]windows-link\)')) { throw 'the patched windows-link is not in use' }
   # The ordinary pc-windows-msvc standard library requires Windows 10. Rebuild std for win7.
   [Environment]::SetEnvironmentVariable($FlagName, '-C target-feature=+crt-static')
   $env:VECTORCRAFT_REQUIRE_WINRES = '1'
-  $BuildArgs = @('-Z', 'build-std=std,panic_unwind', '--locked',
-    '--target', $Target, '--no-default-features', '--features', 'vectorcraft/windows7',
-    '-p', 'vectorcraft', '-p', 'vectorcraft-cli')
-  Invoke-Checked { cargo "+$Toolchain" build @BuildArgs --release }
+  $CargoArgs += @('-p', 'vectorcraft', '-p', 'vectorcraft-cli')
+  Invoke-Checked { cargo "+$Toolchain" build -Z build-std=std,panic_unwind @CargoArgs --release }
   $TargetDir = if ($env:CARGO_TARGET_DIR) { $env:CARGO_TARGET_DIR } else { 'target' }
   $Bin = Join-Path $TargetDir "$Target\release"
   foreach ($Name in 'vectorcraft.exe', 'vectorcraft-cli.exe') {
@@ -58,7 +79,12 @@ try {
   Compress-Archive -Path (Join-Path $Stage '*') -DestinationPath $Zip -Force
   Remove-Item -Recurse -Force $Stage
   Get-Item $Zip
+  if ($Test) {
+    # Exercises the Windows code paths on the build host only; it doesn't prove Windows 7 runtime support.
+    Invoke-Checked { cargo "+$Toolchain" test -Z build-std=std,panic_unwind,test @CargoArgs }
+  }
 } finally {
+  [IO.File]::WriteAllBytes($Lock, $LockBytes)
   [Environment]::SetEnvironmentVariable($FlagName, $OldFlags)
   $env:VECTORCRAFT_REQUIRE_WINRES = $OldWinres
   Pop-Location