build(release): bundle picotool.exe for lab-mode fallback flash

build.ps1 fetches the Raspberry Pi pre-built picotool 2.2.0-3 from
raspberrypi/pico-sdk-tools the first time and caches it under
tools/picotool/, then stages it next to couchlink.exe so the release
zip ships with it. The cache is gitignored; the .gitignore file is
the only tracked artifact under tools/picotool/.

Lab-mode's force_bootsel handler resolves picotool.exe via the bridge
exe directory first, so it works out-of-the-box when running from an
extracted release zip. If the firmware-side CDC + UDP reboot paths
both fail (because the firmware is wedged), the bridge falls back to
`picotool reboot -u -f` and the operator gets a clean BOOTSEL drive
without anyone physically holding the button.

README.txt in the zip now also calls out `couchlink save-wifi` (DPAPI
vault for the lab-mode `wifi_apply_saved` path) and lab-mode itself.

Verified locally: build.ps1 -SkipPico -SkipBridge downloads + stages
picotool.exe (6.1 MB) and the resulting binary runs cleanly
(`picotool help` works).

Author: RealWhyKnot

bridge/src/wifi_vault.rs

@@ -258,7 +258,11 @@ mod tests {
     fn dpapi_round_trip_in_memory() {
         let payload = b"\x01\x05home2\x08hunter12";
         let cipher = dpapi_protect(payload).expect("protect");
-        assert_ne!(cipher.as_slice(), payload.as_slice(), "ciphertext == plaintext");
+        assert_ne!(
+            cipher.as_slice(),
+            payload.as_slice(),
+            "ciphertext == plaintext"
+        );
         let back = dpapi_unprotect(&cipher).expect("unprotect");
         assert_eq!(&back, payload, "round-trip changed bytes");
     }

build.ps1

@@ -84,6 +84,43 @@ if (-not (Test-Path -LiteralPath $FirmwarePicow)) {
 Copy-Item -LiteralPath $FirmwarePico2w -Destination (Join-Path $StageDir "couchlink-pico2w.uf2") -Force
 Copy-Item -LiteralPath $FirmwarePicow  -Destination (Join-Path $StageDir "couchlink-picow.uf2")  -Force
 
+# picotool ships alongside the bridge so lab-mode's `force_bootsel`
+# fallback can drop a wedged Pico into BOOTSEL drive mode without a
+# physical button press. We vendor the official pre-built binary from
+# raspberrypi/pico-sdk-tools and cache it under tools/picotool/ so
+# subsequent builds don't re-download.
+$PicotoolVersion = "2.2.0-3"
+$PicotoolAssetName = "picotool-2.2.0-a4-x64-win.zip"
+$PicotoolUrl = "https://github.com/raspberrypi/pico-sdk-tools/releases/download/v$PicotoolVersion/$PicotoolAssetName"
+$PicotoolCacheDir = Join-Path $RepoRoot "tools\picotool"
+$PicotoolExe = Join-Path $PicotoolCacheDir "picotool.exe"
+if (-not (Test-Path -LiteralPath $PicotoolExe)) {
+    Write-Host ""
+    Write-Host "Fetching picotool $PicotoolVersion from raspberrypi/pico-sdk-tools..." -ForegroundColor Cyan
+    New-Item -ItemType Directory -Force -Path $PicotoolCacheDir | Out-Null
+    $PicotoolZip = Join-Path $PicotoolCacheDir $PicotoolAssetName
+    try {
+        # TLS 1.2 + UseBasicParsing for Windows PowerShell 5.1.
+        [Net.ServicePointManager]::SecurityProtocol = `
+            [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
+        Invoke-WebRequest -Uri $PicotoolUrl -OutFile $PicotoolZip -UseBasicParsing
+    } catch {
+        throw "Failed to download picotool from $PicotoolUrl : $_"
+    }
+    Expand-Archive -LiteralPath $PicotoolZip -DestinationPath $PicotoolCacheDir -Force
+    Remove-Item -LiteralPath $PicotoolZip -Force
+    if (-not (Test-Path -LiteralPath $PicotoolExe)) {
+        # Some sdk-tools releases nest picotool.exe inside a versioned
+        # subfolder; find it and lift it up.
+        $found = Get-ChildItem -LiteralPath $PicotoolCacheDir -Recurse -File -Filter picotool.exe | Select-Object -First 1
+        if ($null -eq $found) {
+            throw "picotool.exe not found in extracted archive at $PicotoolCacheDir"
+        }
+        Copy-Item -LiteralPath $found.FullName -Destination $PicotoolExe -Force
+    }
+}
+Copy-Item -LiteralPath $PicotoolExe -Destination (Join-Path $StageDir "picotool.exe") -Force
+
 $ScriptFiles = @(
     "setup.ps1",
     "doctor.ps1",
@@ -127,6 +164,12 @@ Each subcommand also has a one-shot wrapper script. Right-click and
   flash.ps1              re-flash without re-running setup
   configure-wifi.ps1     re-send Wi-Fi credentials (Pico must be in setup mode)
 
+Lab-mode also ships in this zip. The host runs `couchlink lab-mode` to
+open a remote-test session; `couchlink save-wifi` saves Wi-Fi creds to
+a DPAPI-encrypted local vault (only this Windows login can decrypt).
+picotool.exe is bundled so the lab-mode `force_bootsel` fallback can
+drop the Pico into BOOTSEL drive mode even if the firmware is wedged.
+
 The wrappers record a transcript under
   %LOCALAPPDATA%\ParsecCouchLink\data\logs
 alongside the bridge's own logs, so one folder has everything a

tools/picotool/.gitignore

@@ -0,0 +1,5 @@
+# The pre-built picotool.exe is fetched from raspberrypi/pico-sdk-tools
+# at build time, not vendored into git. build.ps1 caches the zip and
+# the extracted exe here so subsequent builds skip the download.
+*
+!.gitignore