fix: harden and package Windows kernel tools

.github/workflows/build.yml

@@ -0,0 +1,56 @@
+name: Build kernel tools
+
+on:
+  push:
+    branches: [main, "fix/**", "feat/**"]
+    tags: ["v*"]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: windows-2022
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+      - uses: microsoft/setup-msbuild@v2
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy, rustfmt
+      - name: Build, test, and test-sign package
+        shell: powershell
+        run: .\build.ps1 -Version "${{ github.ref_name }}" -TestSign
+      - uses: actions/upload-artifact@v4
+        with:
+          name: kernel-tools-windows-x64-${{ github.sha }}
+          path: |
+            dist/kernel-tools-windows-x64.zip
+            dist/kernel-tools-symbols-windows-x64.zip
+            dist/checksums.sha256
+          if-no-files-found: error
+
+  release:
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: build
+    runs-on: windows-2022
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: kernel-tools-windows-x64-${{ github.sha }}
+          path: dist
+      - name: Publish GitHub release
+        shell: powershell
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: >-
+          gh release create "${{ github.ref_name }}"
+          dist/kernel-tools-windows-x64.zip
+          dist/kernel-tools-symbols-windows-x64.zip
+          dist/checksums.sha256
+          --repo "${{ github.repository }}"
+          --verify-tag
+          --generate-notes
+          --title "Kernel Tools ${{ github.ref_name }}"

.gitignore

@@ -1,5 +1,6 @@
 # Build outputs
 out/
+dist/
 
 # Driver build artifacts
 driver/Debug/
@@ -12,8 +13,6 @@ driver/*.wrn
 
 # Rust build artifacts
 bridge/target/
-bridge/Cargo.lock
-driver/aibridge.vcxproj
 
 # IDE
 .vs/

README.md

@@ -48,19 +48,33 @@ JSON-RPC tools over stdin/stdout.
 - `read_file`
 - `write_file`
 
-## Prerequisites
+## Installable builds
+
+Each version tag publishes `kernel-tools-windows-x64.zip` on GitHub Releases. The
+archive contains the test-signed `aibridge.sys` driver, its public test
+certificate, and `roxy-kernel-bridge.exe`. Roxy downloads a pinned
+release, verifies its SHA-256 digest, and installs it only after explicit user
+confirmation and a UAC prompt.
+
+These development releases require Windows test-signing mode and trusting the
+included public certificate. Normal Secure Boot production deployment requires
+Microsoft attestation or WHQL signing; a GitHub-built test certificate is not a
+production driver signature.
+
+## Build prerequisites
 
 - **Windows 10/11** (x64) with Test Signing enabled: `bcdedit /set testsigning on`
-- **WDK** (Windows Driver Kit) — for building `aibridge.sys`
+- **Visual Studio 2022** with Desktop development with C++
+- **WDK** with the Windows Driver Kit Visual Studio component
+- A matching Windows SDK and WDK version
 - **Rust** (stable MSVC toolchain) — for building `roxy-kernel-bridge.exe`
 - **Administrator** privileges to install the driver
 
 ## Quick Start
 
 ```powershell
-# 1. Build everything
-.\driver\build.ps1
-.\bridge\build.ps1
+# 1. Build, test, and package everything
+.\build.ps1 -TestSign
 
 # 2. Install the driver
 .\install.ps1