feat(windows): icon, windowed exe, no-admin installer

- PyInstaller exe built windowed (console=False) with package/testium.ico
  as the embedded icon (BMP entries for shell compatibility).
- Suppress stray subprocess console windows in the frozen Windows build via
  paths.no_window_kwargs() (CREATE_NO_WINDOW); wheel/source unchanged.
  Applied to py_process, lua_process, bins probes, sys_app_path_win.
- New per-user Inno Setup installer (package/innosetup/): no admin,
  version-scoped AppId/dir so versions install side-by-side, one Start
  Menu entry per version, .ico shipped for shortcut/uninstall icons.
- DESIGN.md + release_note.txt updated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

package/innosetup/build.ps1

@@ -0,0 +1,31 @@
+# Build the Testium installer from testium.iss (needs Inno Setup 6 / ISCC.exe).
+# Install ISCC without admin: winget install --id JRSoftware.InnoSetup -e
+
+$ErrorActionPreference = 'Stop'
+$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
+
+# The PyInstaller exe must exist first.
+$exe = Join-Path $scriptDir '..\pyinstaller\dist\testium.exe'
+if (-not (Test-Path $exe)) {
+    throw "PyInstaller build not found: $exe`nRun package\pyinstaller\build first."
+}
+
+# Locate ISCC.exe: PATH, then the usual install dirs.
+$iscc = (Get-Command ISCC.exe -ErrorAction SilentlyContinue).Source
+if (-not $iscc) {
+    foreach ($p in @(
+        "$env:LOCALAPPDATA\Programs\Inno Setup 6\ISCC.exe",
+        "${env:ProgramFiles(x86)}\Inno Setup 6\ISCC.exe",
+        "$env:ProgramFiles\Inno Setup 6\ISCC.exe")) {
+        if (Test-Path $p) { $iscc = $p; break }
+    }
+}
+if (-not $iscc) {
+    throw "ISCC.exe not found. Install Inno Setup 6:`n    winget install --id JRSoftware.InnoSetup -e"
+}
+
+Write-Host "Using ISCC: $iscc"
+& $iscc (Join-Path $scriptDir 'testium.iss')
+if ($LASTEXITCODE -ne 0) { throw "ISCC failed with exit code $LASTEXITCODE" }
+
+Write-Host "`nInstaller built in: $(Join-Path $scriptDir 'dist')"