fix(updater): separate Windows 7 offline update path

.github/workflows/ci.yml

@@ -79,6 +79,60 @@ jobs:
       - name: Node package publish dry run
         run: pnpm publish:dry-run
 
+  windows-win7-bundle:
+    needs: changes
+    if: needs.changes.outputs.windows_win7_bundle == 'true'
+    runs-on: windows-2022
+    timeout-minutes: 90
+    env:
+      CARGO_INCREMENTAL: "0"
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v6
+        with:
+          version: 10.27.0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 22.13.0
+          cache: pnpm
+
+      - name: Install frontend dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Setup Rust for Windows 7
+        uses: dtolnay/rust-toolchain@nightly
+        with:
+          toolchain: nightly-2026-07-22
+          components: rust-src
+
+      - name: Build frontend
+        run: pnpm build
+
+      - name: Build DBX for Windows 7
+        run: cargo build --locked --package dbx --release --target x86_64-win7-windows-msvc -Z build-std=std,panic_abort
+
+      - name: Prepare WebView2 109 offline runtime
+        shell: pwsh
+        run: ./.github/scripts/prepare-webview2-win7-runtime.ps1
+
+      - name: Bundle Windows 7 offline installer
+        shell: pwsh
+        run: |
+          $bundleDir = "target/x86_64-win7-windows-msvc/release/bundle/nsis"
+          pnpm tauri bundle --bundles nsis --target x86_64-win7-windows-msvc --config src-tauri/tauri.webview2-win7-offline.conf.json
+          $installer = Get-ChildItem $bundleDir -Filter "*.exe" |
+            Sort-Object LastWriteTimeUtc -Descending |
+            Select-Object -First 1
+          if (!$installer) {
+            Write-Error "Missing Windows 7 WebView2 offline installer in ${bundleDir}"
+            exit 1
+          }
+          Get-FileHash -LiteralPath $installer.FullName -Algorithm SHA256
+
   rust-fmt-clippy:
     needs: changes
     if: needs.changes.outputs.rust == 'true'
@@ -299,6 +353,7 @@ jobs:
       jdbc: ${{ steps.filter.outputs.jdbc }}
       agents: ${{ steps.filter.outputs.agents }}
       nix: ${{ steps.filter.outputs.nix }}
+      windows_win7_bundle: ${{ steps.filter.outputs.windows_win7_bundle }}
     steps:
       - uses: actions/checkout@v5
         with:
@@ -350,6 +405,17 @@ jobs:
               - 'flake.lock'
               - '.github/workflows/ci.yml'
               - '.github/workflows/update-nix-pnpm-hash.yml'
+            windows_win7_bundle:
+              - '.github/scripts/prepare-webview2-win7-runtime.ps1'
+              - '.github/workflows/ci.yml'
+              - '.github/workflows/release.yml'
+              - 'src-tauri/tauri.webview2-win7-offline.conf.json'
+              - 'src-tauri/windows/nsis/**'
+              - 'src-tauri/src/commands/update.rs'
+              - 'crates/dbx-core/src/update.rs'
+              - 'Cargo.toml'
+              - 'Cargo.lock'
+              - 'vendor/ctor/**'
 
       - name: Select Rust feature coverage
         id: rust-mode