Bundle native voice runtimes in Windows releases (#44922)

## Why

Windows release packages need the voice helper and native audio libraries. Realtime TLS connections on fresh Windows installations also need platform certificate validation so Windows can retrieve missing trusted roots on demand.

## What changed

- Build and sign the voice helper and audio DLLs for Windows x64 and ARM64, bundle a pinned Microsoft CRT DLL, and verify signatures and runtime receipts before packaging.
- Add verified, pinned Cygwin and native build tools plus MSVC linker, compiler, and path handling fixes for the Windows Bazel builds.
- Include voice resources in primary release archives and WinGet packages. Preserve WinGet executable names, update manifest hashes, and recognize the package root through matching entrypoint metadata. Keep Python runtime wheels voice-free to preserve their existing Windows support floor.
- Use Windows platform TLS validation for realtime WebSockets when no custom CA bundle is configured, preserving custom CA behavior.

## Testing

Add coverage for build-input integrity and unsafe paths, signed Windows runtime assembly, WinGet file and hash preservation, package discovery, and TLS trust selection, untrusted certificate rejection, and hostname validation.

GitOrigin-RevId: 423da35872fa5549d69fd4ca97d922bb49599386

patches/BUILD.bazel

@@ -6,11 +6,13 @@ exports_files([
     "llvm_windows_mingw_compat.patch",
     "rules_rust_build_script_tools_transition.patch",
     "rules_rust_group_build_script_arg_files.patch",
+    "rules_rust_windows_execroot_separators.patch",
     "rules_rust_windows_msvc_direct_link_args.patch",
     "rules_rust_windows_process_wrapper_skip_temp_outputs.patch",
     "rules_cc_rusty_v8_custom_libcxx.patch",
     "rules_foreign_cc_make_cppflags.patch",
     "rules_foreign_cc_make_xcompile.patch",
+    "rules_foreign_cc_make_msvc_stdint.patch",
     "rules_rs_build_script_deps_annotation.patch",
     "rules_rs_windows_msvc_linker.patch",
     "rules_rs_zlib_snapshot_urls.patch",

patches/ring_windows_msvc_include_dirs.patch

@@ -1,8 +1,7 @@
 diff --git a/build.rs b/build.rs
-index 9843ad8aa..573075489 100644
 --- a/build.rs
 +++ b/build.rs
-@@ -346,7 +346,28 @@ fn ring_build_rs_main(c_root_dir: &Path, core_name_and_version: &str) {
+@@ -346,7 +346,27 @@
      // we want to optimize for minimizing the build tools required: No Perl,
      // no nasm, etc.
      let generated_dir = if !is_git {
@@ -31,7 +30,22 @@ index 9843ad8aa..573075489 100644
      } else {
          generate_sources_and_preassemble(
              &out_dir,
-@@ -569,6 +591,15 @@ fn configure_cc(c: &mut cc::Build, target: &Target, c_root_dir: &Path, include_d
+@@ -561,7 +581,13 @@
+     let compiler = c.get_compiler();
+     // FIXME: On Windows AArch64 we currently must use Clang to compile C code
+     let compiler = if target.os == WINDOWS && target.arch == AARCH64 && !compiler.is_like_clang() {
+-        let _ = c.compiler("clang");
++        // Keep inherited MSVC flags compatible with the selected Clang driver.
++        let clang = if compiler.is_like_msvc() {
++            "clang-cl"
++        } else {
++            "clang"
++        };
++        let _ = c.compiler(clang);
+         c.get_compiler()
+     } else {
+         compiler
+@@ -569,6 +595,15 @@
  
      let _ = c.include(c_root_dir.join("include"));
      let _ = c.include(include_dir);

patches/rules_foreign_cc_make_msvc_stdint.patch

@@ -0,0 +1,13 @@
+diff --git a/foreign_cc/built_tools/make_build.bzl b/foreign_cc/built_tools/make_build.bzl
+--- a/foreign_cc/built_tools/make_build.bzl
++++ b/foreign_cc/built_tools/make_build.bzl
+@@ -35,6 +35,9 @@
+             build_str += " gcc"
+             dist_dir = "GccRel"
+         else:
++            # Modern MSVC provides stdint.h, including the intmax_t types that
++            # Make's legacy Windows config otherwise replaces with macros.
++            build_str = 'export CL="$${CL:-}$$ /DHAVE_STDINT_H=1"\n' + build_str
+             dist_dir = "WinRel"
+ 
+         script = [

patches/rules_rs_windows_msvc_linker.patch

@@ -1,13 +1,14 @@
-# What: use Rust's bundled direct linker for Windows x86_64 MSVC toolchains.
-# Scope: standard and bootstrap rules_rs Rust toolchains targeting x86_64 MSVC.
+# What: use Rust's bundled direct linker for Windows x86_64 and ARM64 MSVC toolchains.
+# Scope: standard and bootstrap rules_rs Rust toolchains targeting x86_64 and ARM64 MSVC.
 
 diff --git a/rs/toolchains/declare_rustc_toolchains.bzl b/rs/toolchains/declare_rustc_toolchains.bzl
 --- a/rs/toolchains/declare_rustc_toolchains.bzl
 +++ b/rs/toolchains/declare_rustc_toolchains.bzl
-@@ -88,6 +88,7 @@ def declare_rustc_toolchains(
+@@ -88,6 +88,8 @@ def declare_rustc_toolchains(
              llvm_cov = "@llvm//tools:llvm-cov",
              llvm_profdata = "@llvm//tools:llvm-profdata",
              linker = select({
++                "@rules_rs//rs/platforms/config:aarch64-pc-windows-msvc": "{}rust-lld".format(rustc_repo_label),
 +                "@rules_rs//rs/platforms/config:x86_64-pc-windows-msvc": "{}rust-lld".format(rustc_repo_label),
                  "@platforms//cpu:wasm32": "{}rust-lld".format(rustc_repo_label),
                  "@platforms//cpu:wasm64": "{}rust-lld".format(rustc_repo_label),

patches/rules_rust_windows_execroot_separators.patch

@@ -0,0 +1,52 @@
+--- a/cargo/private/cargo_build_script_runner/lib.rs
++++ b/cargo/private/cargo_build_script_runner/lib.rs
+@@ -337,9 +337,18 @@
+             return "${pwd}".to_owned();
+         }
+ 
+-        value
++        let redacted = value
+             .replace(&format!("{exec_root}/"), "${pwd}/")
+-            .replace(&format!("{exec_root}\\"), "${pwd}\\")
++            .replace(&format!("{exec_root}\\"), "${pwd}\\");
++        #[cfg(windows)]
++        let redacted = {
++            // pkg-config can emit forward slashes for the same Windows root.
++            let root = exec_root.replace('\\', "/");
++            redacted
++                .replace(&format!("{root}/"), "${pwd}/")
++                .replace(&format!("{root}\\"), "${pwd}\\")
++        };
++        redacted
+     }
+ 
+     /// Redact for env vars: uses the generic `${out_dir}` token, resolved
+@@ -630,6 +639,28 @@
+                 link_search_paths:
+                     "-L${pwd}/${bazel-out/cfg/bin/pkg/_bs.out_dir}\n-L${pwd}/other/path".to_owned(),
+             }
++        );
++    }
++
++    #[cfg(windows)]
++    #[test]
++    fn windows_include_metadata_redacts_both_root_spellings() {
++        let root = r"D:\o\execroot\_main";
++        let forward = root.replace('\\', "/");
++        let outputs = vec![BuildScriptOutput::DepEnv(format!(
++            "INCLUDE={forward}/include;{root}\\lib;{forward}-other/include"
++        ))];
++        assert_eq!(
++            BuildScriptOutput::outputs_to_dep_env(&outputs, "glib", root),
++            format!("DEP_GLIB_INCLUDE=${{pwd}}/include;${{pwd}}\\lib;{forward}-other/include")
++        );
++        let directory = std::env::current_dir().unwrap();
++        let directory = directory.to_str().unwrap();
++        let forward = directory.replace('\\', "/");
++        let outputs = vec![BuildScriptOutput::DepEnv(format!("INCLUDE={forward}/."))];
++        assert_eq!(
++            BuildScriptOutput::nonhermetic_absolute_paths(&outputs, directory, ""),
++            Vec::<String>::new()
+         );
+     }
+ 

patches/rules_rust_windows_msvc_direct_link_args.patch

@@ -4,7 +4,7 @@
      use_bpf_linker = toolchain.target_arch in ("bpfeb", "bpfel") and toolchain.linker
 -    if not ld or toolchain.linker_preference == "rust" or use_bpf_linker:
 +    use_windows_msvc_linker = (
-+        toolchain.target_arch == "x86_64" and
++        toolchain.target_arch in ("x86_64", "aarch64") and
 +        toolchain.target_os == "windows" and
 +        toolchain.target_abi == "msvc" and
 +        toolchain.linker != None and