fix(windows-build): make hdwallet git-dep and zcash-cli sidecar build on Windows

[BitHighlander]

Summary

Three fixes to scripts/build-windows-production.ps1 that were required to complete a Windows production build (surfaced while cutting the signed v1.5.3 installer — the prior Windows build never got this far, so these had never been hit).

1. hdwallet device-protocol git-dep prepare — hdwallet-keepkey pulls @keepkey/device-protocol as a git dependency, whose prepare runs mkdir -p ./lib && grpc_tools_node_protoc --plugin=protoc-gen-ts=./node_modules/.bin/protoc-gen-ts .... That fails under cmd.exe (mkdir -p is invalid) and even under bash (native protoc can't exec the extensionless plugin wrapper → %1 is not a valid Win32 application). yarn runs the git-dep prepare even with --ignore-scripts and returns non-zero, but node_modules is fully linked by then. We now tolerate only that specific prepare failure, seed the git-dep's gitignored lib/ from the top-level modules/device-protocol lib (same pinned commit → identical output), and gate on yarn build (tsc).

2. zcash-cli sidecar needs protoc — its build.rs (tonic-build/prost) needs a system protoc, absent from PATH on Windows. Resolve PROTOC: honor $env:PROTOC, else protoc on PATH, else the protoc.exe bundled with grpc-tools in device-protocol's node_modules.

3. StrictMode null guard — the protoc-on-PATH lookup dereferenced .Source on a possibly-null Get-Command result, which throws under Set-StrictMode -Version Latest.

Testing

Used to produce and EV-sign the v1.5.3 Windows installer end-to-end (18/18 binaries signed, installer Authenticode Valid, version.json = 1.5.3). hdwallet yarn build (tsc) and the zcash-cli cargo build --release both verified green with these changes.

Notes

• macOS build path (Makefile) is untouched — this file is Windows-only.
• No submodule/pin changes.

🤖 Generated with Claude Code