Merge anthelion changes into devicie fork

[Tom Plant (pl4nty)]

Summary

Integrates the latest anthelion changes (unpn-org/Komac anthelion) into the devicie fork, alongside our existing changes. This merges 31 upstream anthelion commits via a real merge commit (two parents), so the integration history is preserved and future anthelion pulls stay low-effort.

This is a merge commit; the diff shown is exactly the anthelion delta layered on top of our fork.

Pulling anthelion in future (the repeatable part)

git remote add anthelion https://github.com/unpn-org/Komac.git   # one-time
git config rerere.enabled true                                   # one-time
git fetch anthelion && git merge anthelion/anthelion             # each pull
git push

rerere recorded all 17 conflict resolutions from this merge, so future merges auto-replay them and you only resolve genuinely new divergence.

Changes

Conflict resolutions (kept both sides' features where possible):

• CI workflows (audit/build/release): kept our versions (anthelion had deleted them). The four upstream workflows we never modified (renovate, vhs, update-graphql-schema, update-inno-dependencies) follow anthelion's deletion.
• serde: kept our serde_yaml + serini stack; reverted anthelion's serde-saphyr usage in the shared files while preserving their other changes in those files (retry middleware, font support, changed signatures).
• GitHub owner/repo: adopted anthelion's configurable EnvStr system (env-var overridable) but kept our pl4nty/winget-extras as the defaults.
• update_version: preserved our optional package_version + PE ProductVersion inference flow; grafted in anthelion's font handling and locale normalization.
• zip/downloader/prompts/etc.: unioned features (e.g. our lowest-level-exe selection + anthelion's lowercase_extension; our CI prompt suppression + anthelion's list-prompt refactor).
• Threaded anthelion's new font parameters through our get_versions/get_manifests/get_existing_pull_request/PackagePath call sites.

winget-types (decision worth reviewing):

• Switched the [patch.crates-io] source to anthelion's fork (UnownPlain/winget-types, anthelion branch) with features [serde, std, chrono] and no serde-saphyr — komac still uses serde_yaml.
• Reason: anthelion's code requires API that only that fork provides (InstallerType::Velopack/Squirrel, LanguageTag accessors, ValidFileExtensions), which even upstream 0.4.3 lacks. Our own devicie/winget-types fork carried no meaningful custom code (a one-line Cargo.toml tweak plus two upstream PRs), so nothing significant is lost. Adapted our installer analyzers (installshield/qt return codes, autoupdate strategies) to this fork's API. The now-unused vendor/winget-types submodule remains in-tree and can be removed in a follow-up.

Verification

• cargo check --bin komac passes (Rust 1.95, the repo MSRV).
• cargo clippy --bin komac with RUSTFLAGS="-D warnings" passes (fixed a redundant-closure and an unfulfilled #[expect] introduced by the merge).

Follow-ups / notes

• Publishing to crates.io (publish_dry_run / release.yml) with a git-patched winget-types needs consideration — cargo publish ignores [patch] and would resolve the unpublished API against crates.io 0.4.3. This tension predates this merge (our vendored patch had the same property).
• vendor/winget-types submodule is now unused and can be dropped.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LAsaSyfFuR5pcV43kApw5x

---

Generated by Claude Code