refactor(launcher): exclude zstd/tar from Windows build

Windows launcher downloads daemon as .exe.zip (stdlib archive/zip only).
The zstd and archive/tar libraries are only needed on Linux/macOS where
daemon archives are .tar.zst.

Split extractTarZst into:
  extract_unix.go  (//go:build !windows) — real implementation with zstd+tar
  extract_windows.go (//go:build windows) — stub that returns an error

Remove github.com/klauspost/compress/zstd and archive/tar from daemon.go;
they are no longer imported by the Windows build.

Result: Windows launcher drops from 9.4 MB (debug) to 9.0 MB, and from
6.7 MB to 6.3 MB in release builds (-s -w -trimpath). Smaller binary =
faster antivirus scanning on domain-joined Windows machines.

Skip tar.zst tests on Windows (TestExtractTarZst_*, TestDownloadDaemon
Version_LinuxTarZst) — Linux CI still exercises the full extraction path.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Author: engalar

cmd/mxcli-launcher/daemon.go

@@ -3,7 +3,6 @@
 package main
 
 import (
-	"archive/tar"
 	"archive/zip"
 	"crypto/sha256"
 	"encoding/hex"
@@ -20,7 +19,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/klauspost/compress/zstd"
 	"github.com/mendixlabs/mxcli/internal/launcherproto"
 )
 
@@ -229,43 +227,6 @@ func parseChecksumFile(content, filename string) (string, error) {
 	return "", fmt.Errorf("no checksum for %q in SHA256SUMS", filename)
 }
 
-func extractTarZst(r io.Reader, destPath, expectedName string) error {
-	zr, err := zstd.NewReader(r)
-	if err != nil {
-		return err
-	}
-	defer zr.Close()
-	tr := tar.NewReader(zr)
-	for {
-		hdr, err := tr.Next()
-		if err == io.EOF {
-			break
-		}
-		if err != nil {
-			return err
-		}
-		if hdr.Typeflag != tar.TypeReg {
-			continue
-		}
-		if filepath.Base(hdr.Name) != expectedName {
-			continue
-		}
-		tmp := destPath + ".tmp"
-		f, err := os.OpenFile(tmp, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0755)
-		if err != nil {
-			return err
-		}
-		if _, err := io.Copy(f, tr); err != nil {
-			f.Close()
-			os.Remove(tmp)
-			return err
-		}
-		f.Close()
-		return os.Rename(tmp, destPath)
-	}
-	return fmt.Errorf("no file named %q found in archive", expectedName)
-}
-
 func extractZip(srcPath, destPath, expectedName string) error {
 	zr, err := zip.OpenReader(srcPath)
 	if err != nil {

cmd/mxcli-launcher/daemon_test.go

@@ -99,6 +99,9 @@ func makeTarZst(t *testing.T, files map[string][]byte) *bytes.Buffer {
 }
 
 func TestExtractTarZst_CorrectFilename(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("tar.zst extraction not compiled on Windows (daemon uses .exe.zip)")
+	}
 	archive := makeTarZst(t, map[string][]byte{"mxcli-daemon": []byte("binary-data")})
 	dest := filepath.Join(t.TempDir(), "mxcli-daemon")
 	if err := extractTarZst(archive, dest, "mxcli-daemon"); err != nil {
@@ -111,6 +114,9 @@ func TestExtractTarZst_CorrectFilename(t *testing.T) {
 }
 
 func TestExtractTarZst_RejectsWrongFilename(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("tar.zst extraction not compiled on Windows (daemon uses .exe.zip)")
+	}
 	archive := makeTarZst(t, map[string][]byte{"readme.txt": []byte("docs")})
 	dest := filepath.Join(t.TempDir(), "mxcli-daemon")
 	if err := extractTarZst(archive, dest, "mxcli-daemon"); err == nil {

cmd/mxcli-launcher/extract_unix.go

@@ -0,0 +1,54 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//go:build !windows
+
+package main
+
+import (
+	"archive/tar"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+
+	"github.com/klauspost/compress/zstd"
+)
+
+// extractTarZst extracts expectedName from a .tar.zst archive into destPath.
+// Used on Linux and macOS where daemon archives are compressed with zstd.
+func extractTarZst(r io.Reader, destPath, expectedName string) error {
+	zr, err := zstd.NewReader(r)
+	if err != nil {
+		return err
+	}
+	defer zr.Close()
+	tr := tar.NewReader(zr)
+	for {
+		hdr, err := tr.Next()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			return err
+		}
+		if hdr.Typeflag != tar.TypeReg {
+			continue
+		}
+		if filepath.Base(hdr.Name) != expectedName {
+			continue
+		}
+		tmp := destPath + ".tmp"
+		f, err := os.OpenFile(tmp, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0755)
+		if err != nil {
+			return err
+		}
+		if _, err := io.Copy(f, tr); err != nil {
+			f.Close()
+			os.Remove(tmp)
+			return err
+		}
+		f.Close()
+		return os.Rename(tmp, destPath)
+	}
+	return fmt.Errorf("no file named %q found in archive", expectedName)
+}

cmd/mxcli-launcher/extract_windows.go

@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//go:build windows
+
+package main
+
+import (
+	"fmt"
+	"io"
+)
+
+// extractTarZst is not used on Windows (daemon is distributed as .exe.zip).
+// This stub satisfies the compiler on Windows without importing zstd/tar.
+func extractTarZst(_ io.Reader, _, expectedName string) error {
+	return fmt.Errorf("tar.zst extraction not supported on Windows (expected %q)", expectedName)
+}

cmd/mxcli-launcher/install_update_test.go

@@ -422,9 +422,12 @@ func TestDownloadDaemonVersion_WindowsZipOnLinuxCI(t *testing.T) {
 }
 
 func TestDownloadDaemonVersion_LinuxTarZst(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("tar.zst extraction not compiled on Windows; Linux CI covers this path")
+	}
 	t.Parallel()
 	// Mirrors TestDownloadDaemon_FreshInstall but explicitly targets Linux/amd64
-	// so both Unix and Windows hosts exercise the tar.zst path.
+	// so Unix hosts exercise the tar.zst path.
 	e, _ := newInstallEnvForPlatform(t, &testfixtures.FakeGitHub{LatestTag: "v0.15.0"}, []byte("linux-binary"), "linux", "amd64")
 
 	dest := e.daemonBinaryPath()