{Packaging} Prepare native Windows ARM64 packages

[René Dudfield (illume)]

WIP: this is a proof of concept trying to see what is working/not working for windows arm64.
Note: at least 3 upstream packages are blocked on cryptography 51 being released with windows arm64 builds.

---

Related command

N/A

Description

Prepare native Windows ARM64 Azure CLI packages for
Azure/azure-cli#29317.

This draft:

• adds ARM64 support to the Windows embedded-Python builder;
• upgrades to WiX 3.14.1, verifies its SHA-256 digest, and adds ARM64 MSI
  product metadata and upgrade handling;
• builds and tests ARM64 MSI and ZIP artifacts on a proposed native Windows
  ARM64 pool;
• updates manual and pipeline installation tests for the native Program Files
  location; and
• gates ARM64 dependency verification, builds, and installation tests behind
  the enableWindowsArm64 pipeline parameter, which defaults to false.

The existing released dependency pins remain unchanged so ordinary development
and CI environments stay resolvable. Enable the ARM64 jobs only after:

• cryptography 51 publishes its merged Windows ARM64 wheels, tracked by
  pyca/cryptography#15350;
• a compatible pyOpenSSL release is available;
• the Windows lock uses architecture-specific pins that preserve win32
  support; and
• pool-windows-2022-arm64 is a proposed pool name and must be provisioned or
  replaced with the platform engineering team's final 1ES pool.

Keep this PR in draft until those dependency and infrastructure gates are
available.

Assisted by Copilot.

Testing Guide

Completed:

python build_scripts/windows/tests/test_arm64_packaging.py
python -m py_compile \
  build_scripts/windows/scripts/test_msi_package.py \
  build_scripts/windows/tests/test_arm64_packaging.py
git -c core.whitespace=cr-at-eol diff --check upstream/dev..HEAD

• All five focused packaging configuration tests pass.
• Both changed Azure Pipelines YAML files parse successfully.
• WiX 3.14.1 Wix.targets maps InstallerPlatform from Platform; the pinned
  release archive matches SHA-256
  6ac824e1642d6f7277d0ed7ea09411a508f6116ba6fae0aa5f2c7daa2ff43d31.
• CPython 3.14.7 publishes the required Windows ARM64 embeddable archive.
• A binary-only audit of the current 142 Windows requirements found 139
  compatible ARM64 wheels. ARM64 CI remains disabled by default because the
  current cryptography, psutil, and related pyOpenSSL pins require a coordinated
  update.
• A fork-only native Windows ARM64
  source-build probe
  downloaded the ARM64 embedded Python runtime and built the local Azure CLI,
  core, and telemetry wheels. Pip selected source archives for bcrypt and
  cryptography; cryptography then stopped before Rust compilation because its
  isolated embedded-Python build environment could not import maturin.

Not completed:

• A complete native Windows ARM64 MSI/ZIP build. Source fallback needs the
  upstream cryptography wheel toolchain (maturin, Rust, and static OpenSSL),
  and the proposed Azure Pipelines pool is not yet configured.
• ARM64 dependency-lock verification, because cryptography 51 and the
  compatible pyOpenSSL release do not yet exist.

History Notes

N/A

---

This checklist is used to make sure that common guidelines for a pull request are followed.

• The PR title and description has followed the guideline in Submitting Pull Requests.

• I adhere to the Command Guidelines.

• I adhere to the Error Handling Guidelines.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[microsoft-github-policy-service]

Thank you for your contribution René Dudfield (@illume)! We will review the pull request and get back to you soon.

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[René Dudfield (illume)]

/azp run

[azure-pipelines]

Commenter does not have sufficient privileges for PR 34195 in repo Azure/azure-cli

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Yong Zhang (yonzhan)]

Please fix CI issues