feat(desktop): add win7 workflow

.github/workflows/release-win7.yml

@@ -0,0 +1,111 @@
+name: Release Desktop (Win7 legacy)
+
+# One-off / on-demand build for legacy Windows 7 / 8 / 8.1 users.
+#
+# The main release pipeline (release.yml) ships Electron 33 (Chromium 130+) and
+# a PyInstaller backend built with Python 3.11 — NEITHER runs on Windows 7,
+# which is why those users hit "不是有效的 Win32 应用程序" when launching the exe.
+#
+# To support Win7 we must pin BOTH halves to the last versions that still
+# target it:
+#   - Electron 22.3.27  (Chromium 108, last major to support Win7/8/8.1)
+#   - Python  3.8        (last CPython to support Win7)
+#
+# This is a SEPARATE, manually-triggered workflow so it never touches the
+# production R2/D1 publish flow or the auto-update feed. It just produces an
+# unsigned NSIS installer and uploads it as a build artifact for manual
+# download + testing. Delete this file whenever Win7 support is no longer worth
+# maintaining — the main pipeline is completely unaffected.
+#
+# IMPORTANT for end users: Win7 must have SP1 + update KB2533623 (or the rollup
+# KB4457144) installed, otherwise the Python 3.8 backend still fails to start.
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to stamp (e.g. 2.1.3-win7). Used for package.json and artifact name."
+        type: string
+        default: "0.0.0-win7"
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build Windows x64 (Win7 legacy)
+    runs-on: windows-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # Python 3.8 is the last CPython that supports Windows 7. A backend built
+      # with it (via PyInstaller) still runs on Win7 even though the CI host is
+      # Server 2022 — PyInstaller's bootloader targets the interpreter's minimum
+      # OS, not the build machine's.
+      - name: Set up Python 3.8
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.8"
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+
+      - name: Build Python backend (PyInstaller, Python 3.8)
+        shell: bash
+        run: |
+          python -m pip install --upgrade pip
+          # Deps are mostly unpinned, so pip will resolve the newest versions
+          # that still ship a Python 3.8 wheel. This is exactly what we want for
+          # a Win7-targeted backend.
+          pip install -r desktop/build/requirements-desktop.txt
+          pip install pyinstaller
+          # Run from repo root so the spec's relative datas resolve correctly.
+          pyinstaller desktop/build/cowagent-backend.spec \
+            --noconfirm \
+            --distpath desktop/build/dist \
+            --workpath desktop/build/build-work
+
+      - name: Install desktop deps
+        working-directory: desktop
+        run: npm ci
+
+      - name: Write version into package.json
+        working-directory: desktop
+        shell: bash
+        run: npm version "${{ github.event.inputs.version }}" --no-git-tag-version --allow-same-version
+
+      # Downgrade Electron to the last Win7-capable major (22). --no-save keeps
+      # this out of package.json so the repo's committed deps stay on Electron 33
+      # for the main pipeline. electron-builder reads the installed Electron
+      # version from node_modules, so this is all that's needed to package v22.
+      - name: Pin Electron to 22 (last Win7-capable)
+        working-directory: desktop
+        run: npm install --no-save electron@22.3.27
+
+      - name: Compile (vite + tsc)
+        working-directory: desktop
+        shell: bash
+        run: npm run build
+
+      # Unsigned NSIS x64 build using the base config in package.json (no win
+      # sign hook, no R2/D1, no auto-update publish). --publish never still emits
+      # the installer. Invoke via node (not npx) to avoid the Windows npx.cmd
+      # batch-wrapper returning before the process finishes (see release.yml).
+      - name: Build installer (electron-builder, Electron 22)
+        working-directory: desktop
+        shell: bash
+        run: node node_modules/electron-builder/cli.js --win --x64 --publish never
+
+      - name: Upload installer artifact
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: cowagent-win7-x64
+          path: |
+            desktop/release/*.exe
+            desktop/release/*.blockmap
+          if-no-files-found: warn
+          retention-days: 7