CI: fix the MSVC exit-code check and verify .NET 3.5 before bundling

Two follow-ups to the provisioning step.

The exit-code check never worked. %VSEXIT% and %ERRORLEVEL% inside a
parenthesised cmd block are substituted when the block is PARSED, not
when it runs, so the installer's real result was never read — the log
printed "installer failed with " with an empty code, then continued
anyway. It happened to be harmless because the install had in fact
succeeded, but a genuine failure would have sailed past. Now uses
delayed expansion.

Added a .NET 3.5 check. WiX 3.x candle.exe is a .NET 2.0/3.5
application, and Tauri aborts the entire bundle when the MSI target
fails — so a missing runtime silently costs the NSIS installer too, not
just the MSI. Windows 11 ships NetFx3 as DisabledWithPayloadRemoved and
Windows Update could not supply the payload on our runner even across a
reboot; it needed /Source from a mounted ISO. Rather than guess, the job
now fails early with the exact dism command.

Verified on the runner: MSVC Build Tools 2022 installed, the Rust build
completed in 3m59s and produced triple-c.exe, and NetFx3 is now Enabled
with v2.0.50727 present.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitea/workflows/build-app.yml

@@ -362,33 +362,62 @@ jobs:
         run: |
           rem Tauri links with MSVC, so rustc needs link.exe and the Windows SDK.
           rem This job previously assumed a hand-provisioned runner; a runner
-          rem without them registers fine, accepts windows-latest jobs, and then
-          rem fails at link time with "linker `link.exe` not found" after having
-          rem already downloaded the whole crate graph.
+          rem without them registers fine, advertises windows-latest, accepts the
+          rem job, downloads the whole crate graph and only then fails at link
+          rem time with "linker `link.exe` not found".
           rem
-          rem rustc locates MSVC through vswhere/the registry rather than PATH,
-          rem so installing is sufficient — no dev-shell activation needed here.
+          rem rustc finds MSVC via vswhere and the registry rather than PATH, so
+          rem installing is enough - no dev-shell activation needed here.
+          rem
+          rem Delayed expansion is required: %VAR% inside a parenthesised block
+          rem is substituted when the block is PARSED, not when it runs, so both
+          rem %ERRORLEVEL% and %VSEXIT% would read as their pre-block values.
+          setlocal enabledelayedexpansion
+          set "VCPATH="
           set "VSWHERE=%ProgramFiles(x86)%\Microsoft Visual Studio\Installer\vswhere.exe"
           if exist "%VSWHERE%" (
-            "%VSWHERE%" -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath > "%TEMP%\vcpath.txt" 2>nul
-            for /f "usebackq delims=" %%i in ("%TEMP%\vcpath.txt") do set "VCPATH=%%i"
+            for /f "usebackq delims=" %%i in (`"%VSWHERE%" -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath`) do set "VCPATH=%%i"
           )
           if defined VCPATH (
-            echo MSVC build tools already present at %VCPATH%
+            echo MSVC build tools already present at !VCPATH!
           ) else (
             echo MSVC build tools not found - installing Visual Studio Build Tools
             curl -fSL -o "%TEMP%\vs_BuildTools.exe" https://aka.ms/vs/17/release/vs_BuildTools.exe || exit /b 1
-            rem 3010 means "installed, reboot pending" and is a success for our purposes.
-            "%TEMP%\vs_BuildTools.exe" --quiet --wait --norestart --nocache ^
-              --add Microsoft.VisualStudio.Workload.VCTools --includeRecommended
-            set "VSEXIT=%ERRORLEVEL%"
+            "%TEMP%\vs_BuildTools.exe" --quiet --wait --norestart --nocache --add Microsoft.VisualStudio.Workload.VCTools --includeRecommended
+            set "VSEXIT=!ERRORLEVEL!"
             del "%TEMP%\vs_BuildTools.exe" 2>nul
-            if not "%VSEXIT%"=="0" if not "%VSEXIT%"=="3010" (
-              echo Visual Studio Build Tools installer failed with %VSEXIT%
-              exit /b %VSEXIT%
+            rem 3010 means installed, reboot pending - a success for our purposes.
+            if not "!VSEXIT!"=="0" if not "!VSEXIT!"=="3010" (
+              echo Visual Studio Build Tools installer failed with exit code !VSEXIT!
+              exit /b 1
             )
             echo Visual Studio Build Tools installed
           )
+          endlocal
+
+      - name: Verify .NET 3.5 for the MSI bundler
+        shell: cmd
+        run: |
+          rem WiX 3.x candle.exe is a .NET 2.0/3.5 application, and Tauri aborts
+          rem the whole bundle when the MSI target fails - taking the NSIS
+          rem installer with it. Windows 11 ships NetFx3 as
+          rem DisabledWithPayloadRemoved, and enabling it needs a payload that
+          rem Windows Update cannot always supply, so this checks rather than
+          rem guesses and tells you exactly how to fix it on the runner.
+          if exist "%WINDIR%\Microsoft.NET\Framework64\v2.0.50727" (
+            echo .NET 3.5 runtime present - WiX can run
+          ) else (
+            echo ERROR: .NET 3.5 is missing, so WiX candle.exe cannot run and the
+            echo        MSI bundle will fail, which also suppresses the NSIS build.
+            echo.
+            echo   Fix on this runner, with a Windows ISO mounted ^(e.g. D:^):
+            echo     dism /Online /Enable-Feature /FeatureName:NetFx3 /All ^
+            echo          /Source:D:\sources\sxs /LimitAccess
+            echo.
+            echo   Windows Update alone is not sufficient when the feature reports
+            echo   DisabledWithPayloadRemoved.
+            exit /b 1
+          )
       - name: Install Rust stable
         run: |
           where rustup >nul 2>&1 && (