feat: embed canonical branded DIG icon in Windows binaries (#2917)

[MichaelTaylor3d]

DO NOT MERGE — gate round in progress. Refs #2917.

[MichaelTaylor3d]

Security audit — PASS

Head SHA audited: bb5b665eec6be0e7e54ff0681283a41cb9714dec

1. Cargo.lock diff scope — confirmed confined. Diffed base (7ee48b4) vs head lockfile directly (not just the PR's rendered diff): the only changes are the embed-resource subtree (embed-resource 3.0.11, toml 1.1.2+spec-1.1.0, vswhom 0.1.0, vswhom-sys 0.1.3, winreg 0.55.0) plus the 0.29.9 -> 0.29.10 workspace version bump on the eleven digstore-* members. windows-sys (0.48.0/0.52.0/0.59.0/0.61.2), socket2 (0.5.10/0.6.4) and rustix (1.1.4) are byte-identical between base and head — winreg's dependency on windows-sys 0.59.0 resolves against a version already present in the base lockfile pre-PR, not a new bump. No dig-node-style drag-in, no dig-dns-style rustix consolidation.

2. [target.'cfg(windows)'.build-dependencies] table placement — checked the full post-change Cargo.toml for all three crates (dig-resolver, digstore-cli, digstore-host), not just the added hunk. In every case the new table is a clean standalone insertion before [dependencies], containing only the single embed-resource = "3" line. No existing dependency (e.g. digstore-host's optional hex/url/futures, digstore-cli's long [dependencies] list) sits inside or after the new header — nothing was reclassified from runtime to build-only. No mid-table split occurred.

3. wasm guest — crates/digstore-prover/guest does not appear in the PR's file list at all; the root Cargo.toml's exclude = ["crates/digstore-prover/guest", "crates/dig-client-wasm"] line is untouched context. Confirmed untouched — no resource, no build.rs.

No LIVE findings. build.rs invocations are static (fixed relative path to assets/dig.rc, no attacker-influenced input), scripts/check-icon.sh does a plain sha256sum compare with no injection surface, and the new CI icon job only reads repo files on an ubuntu runner. digs.exe/dig-store.exe and digstore.exe (the install-tree copy) both pick up the icon via cargo:rustc-link-arg-bins, consistent with the PR's own build.rs comments.

Scope audited: .github/workflows/ci.yml, CHANGELOG.md, Cargo.lock, Cargo.toml, assets/dig.rc (assets/dig.ico binary not content-audited — sha256-pinned and CI-gated instead), crates/{dig-resolver,digstore-cli,digstore-host}/{Cargo.toml,build.rs}, scripts/check-icon.sh. Not covered: runtime behavior of embed_resource 3.0.11 itself (third-party crate, not re-audited here) and whether the vendored dig.ico bytes are visually/structurally what they claim to be beyond the pinned hash.

Worktree note: worked entirely read-only via gh api/gh pr diff against a scratch temp dir; D:\worktrees\digs-2917 was never touched.

[MichaelTaylor3d]

Correctness review — PASS

Head SHA reviewed: bb5b665eec6be0e7e54ff0681283a41cb9714dec

Note: artifact-level PE-resource verification (built binaries checked against
verify_pe_icon.py) is being supplied separately by the orchestrator directly on this
PR — not run by this gate. Everything below is read/mutation-only, no cargo build.

1. Gate non-vacuous — appended one byte to a scratch copy of assets/dig.ico and ran
   scripts/check-icon.sh: exits 1 with a clear drift message, restored original after.
   Confirmed with the original bytes it prints OK (exit 0). The pin can fail.
2. Canonical bytes — sha256sum assets/dig.ico = 2f0fb11a1254fc9275248dc340b7aa9c7236484a9531f8aaad2e4bcdf8900096, wc -c = 50443. Matches the literal exactly.
3. assets/dig.rc — exactly one ICON statement (1 ICON "dig.ico"), ordinal 1, no RT_MANIFEST/VERSIONINFO declared. Comment block explicitly documents why no manifest is declared here (linker collision).
4. Scoping — digstore-cli ships two bins (dig-store, digs), both correctly branded via -bins link args; dig-resolver (1 bin) and digstore-host's dighost (feature-gated bin) likewise. crates/digstore-prover/guest (the wasm guest, excluded from the workspace) has zero diff — confirmed untouched (git diff origin/main -- crates/digstore-prover/guest empty, git status --porcelain empty).
5. TOML table placement — checked all three new [target.'cfg(windows)'.build-dependencies] headers (dig-resolver, digstore-cli, digstore-host Cargo.toml) against origin/main: each is a clean standalone insertion immediately followed by a blank line then [dependencies]. None of them precede or split an existing table — unlike the dig-node incident, nothing gets silently reclassified.
6. Lockfile diff, edge-aware (git diff origin/main -- Cargo.lock | grep -E '^[+-]' | grep -v '^[+-][+-]', every line read): the only new packages are embed-resource 3.0.11 and its direct/transitive deps (toml 1.1.2, vswhom 0.1.0, vswhom-sys 0.1.3, winreg 0.55.0), plus the expected workspace version bump (0.29.9 -> 0.29.10) repeated per member. windows-sys (0.48.0/0.52.0/0.59.0/0.61.2) has no added/removed name = line — winreg's dep on windows-sys 0.59.0 resolves to a version already present pre-PR, confirmed by the package-name-only diff (grep '^[+-]name') showing only the 5 new packages. No edge-rewrite drag-in.
7. CI job name — .github/workflows/ci.yml:245 is name: icon asset (sha256 pin), exact string match. Runs on ubuntu-latest, dependency-free, independent of the compile jobs.
8. Doc-truth — assets/dig.rc comments, scripts/check-icon.sh comments, and the CHANGELOG.md entry all describe present-state behavior of this repo only (no forward-looking claim about macOS/Linux/installer siblings, which are correctly out of scope per #2924/#2925/#2926).
9. No behaviour change — diff is confined to .github/workflows/ci.yml, CHANGELOG.md, Cargo.lock, Cargo.toml (version bump only), assets/dig.ico+dig.rc, three crates' Cargo.toml+build.rs, and scripts/check-icon.sh. No source file under src/ touched; no elevation/manifest/API change.

No blocking findings; no inline threads opened (nothing at file:line to contest). Not run by this gate: cargo build / PE-resource verification of the compiled binaries (supplied separately by the orchestrator on this PR) and third-party audit of embed-resource 3.0.11 itself.