build: production Windows release pipeline (PyInstaller, SBOM, CI, signing hook)

ProxyChainManager.spec

@@ -56,12 +56,9 @@ a = Analysis(
 )
 pyz = PYZ(a.pure)
 
-exe = EXE(
-    pyz,
-    a.scripts,
-    a.binaries,
-    a.datas,
-    [],
+# Windows VERSIONINFO — generated by scripts/generate_version_info.py before build.
+_version_file = _ROOT / 'build' / 'version_info.txt'
+_exe_kwargs = dict(
     name='ProxyChainManager',
     debug=False,
     bootloader_ignore_signals=False,
@@ -77,3 +74,14 @@ exe = EXE(
     entitlements_file=None,
     uac_admin=True,
 )
+if _version_file.is_file():
+    _exe_kwargs['version'] = str(_version_file)
+
+exe = EXE(
+    pyz,
+    a.scripts,
+    a.binaries,
+    a.datas,
+    [],
+    **_exe_kwargs,
+)