build: package universal Windows runtime and verify automatic CPU fallback

docs/VALIDATION.md

@@ -7,19 +7,34 @@ and `SEARCHI_FORCE_CPU=1`.
 
 ## Current integration checkpoint (2026-10-12)
 
-The Windows archive packager has two controlled Python regressions: complete
-required file collection with checksum verification and user-settings exclusion,
-and mismatched worker architecture preserving the previous archive. Both pass.
-An actual CPU-only Tauri embedded-frontend Release build has been started;
-the embedded-frontend Release application build completed in 7m 25s. CPU-only
-describes its VM test context, not a supported end-user edition. The normal
-worker build/staging defaults are now auto and require GPU compilation support
-alongside CPU fallback. The previously staged CPU worker remains an internal
-test artifact; archive creation, automatic-runtime dependency packaging, native
-launch outside the source tree and clean-machine installation remain unverified.
-Actual `auto` configuration correctly rejected this VM's missing Vulkan library,
-headers and `glslc`; no GPU-capable worker/package is claimed. Both staging
-regressions still pass using explicit internal CPU test configuration.
+The Windows-x64 universal worker built with CPU and Vulkan enabled, using the
+pinned official LunarG 1.4.363.0 SDK (download hash and publisher signature
+verified). Copy-only installation and later provenance/swap validation ran in
+the workspace; no driver/registry installation or GPU inference occurred.
+The desktop embedded-frontend Release build completed and was rebuilt with
+startup fallback. The generated unsigned Windows archive includes its worker,
+app-local Vulkan loader, FFmpeg/FFprobe and named notices. Six packaging
+regressions verify exact archived-byte hashes, changes during copying, notices,
+architecture mismatch, failed-write cleanup and preservation of previous output.
+
+The actual extracted package's worker was requested in `auto` mode, with
+`SEARCHI_FORCE_CPU` absent and Vulkan disabled only in that child. It detected
+a CPU-only backend registry and produced a real normalized 768d code vector;
+its decoder started successfully. All 13 recorded package files passed hash
+checks. [Raw package evidence](evidence/windows-package-cpu-fallback.json).
+The final local archive is 140,971,051 bytes; its digest is included in that
+evidence. It has not been published as a production release.
+This is controlled no-provider fallback, not a physical GPU/driver test or
+native GUI/clean-machine certification. Actual GPU precision/parity, native
+application interaction, signed installers and other OS/architecture gates stay open.
+Two real code tests and existing Google text-reference/tail parity passed on
+the GPU-capable worker's forced-CPU path. Four startup regressions check one
+CPU retry after automatic startup transport failure while preserving invalid
+protocol/model rejection and explicit-CPU behavior. Eight Vulkan-provisioning
+tests verify cache provenance, bounds, atomic loader reuse and SDK swap rollback.
+The integrated workspace and native desktop tests passed, along with strict
+all-target Rust Clippy, frontend Release build and formatting checks. Gitea
+Actions remain disabled at Karl's request.
 
 Offline staging now verifies the native license and every bundled Google asset
 before modifying resources. Two Python regressions verify missing-model rejection