Add Windows cross-compilation via MinGW, and fix Docker build permission

issues on vboxsf-mounted checkouts

New `make dist-win`/`package-win` targets (folded into `dist`/`package`
alongside the renamed `dist-linux`/`package-linux`) cross-compile
systemshock.exe via MinGW, using prebuilt SDL2/SDL2_mixer/GLEW/
fluidsynth-lite baked into the build-image - no Windows machine or Wine
needed to build it, confirmed working and playable on a real Windows
machine. dist-win/ ships DLLs flat alongside the exe plus a new
res/run.bat launcher, packaged into a .zip the same way dist/ becomes a
.tar.gz.

Also fixes three build-image bugs hit while testing on a VirtualBox
vboxsf-mounted checkout: build-engine.sh/docker-entrypoint.sh losing
their execute bit (chmod +x on restrictive source perms), the container
user missing access to /workspace's supplementary vboxsf group, and
cp -a failing on symlink/hard-link creation (vboxsf doesn't support
either) - now falls back to dereferencing copies when detected. Also
adds Docker/zip/etc. prerequisites to the README for both the desktop
and Quest builds.

Makefile

@@ -1,20 +1,28 @@
-# Assembles dist/ - a self-contained, runnable copy of System Shock -
-# from the compiled engine (built via Docker, see build-image.sh/
-# run-image.sh) and the game assets extracted from a purchased copy (see
+# Assembles dist/ (Linux) and dist-win/ (Windows, cross-compiled via
+# MinGW) - self-contained, runnable copies of System Shock - from the
+# compiled engine (built via Docker, see build-image.sh/run-image.sh) and
+# the game assets extracted from a purchased copy (see
 # res/assets/extract_assets.sh). Building the engine needs the build-image
 # (./build-image.sh, once); everything else here is plain file copying.
+# `dist-linux`/`dist-win` build just one platform; plain `dist` builds
+# both.
 #
-# `make package` instead builds a redistributable tarball that omits the
-# proprietary game assets entirely (see res/assets/GET_ASSETS.txt, which
-# it ships in their place) - this is what CI publishes.
+# `make package` instead builds redistributable archives (a .tar.gz for
+# Linux, a .zip for Windows) that omit the proprietary game assets
+# entirely (see res/assets/GET_ASSETS.txt, which they ship in their
+# place) - this is what CI publishes. Same dist-linux/dist-win/(both)
+# split via package-linux/package-win/package.
 
-DIST_DIR    := dist
-ENGINE_OUT  := engine/.build-output
-ASSETS_DIR  := res/assets/ss_ee
-BUILD_DIR   := build
-ARCH        := $(shell uname -m)
+DIST_DIR       := dist
+DIST_WIN_DIR   := dist-win
+ENGINE_OUT     := engine/.build-output
+ENGINE_OUT_WIN := engine/.build-output-win
+ASSETS_DIR     := res/assets/ss_ee
+BUILD_DIR      := build
+ARCH           := $(shell uname -m)
 
-.PHONY: all dist build-image engine assets package apk android-studio clean
+.PHONY: all dist dist-linux dist-win build-image engine engine-win assets \
+	package package-linux package-win apk android-studio clean
 
 all: dist
 
@@ -40,6 +48,16 @@ engine:
 		./run-image.sh; \
 	fi
 
+# Cross-compiles engine/ for Windows via MinGW - see build-engine-win.sh
+# for why this can't share build-engine.sh's engine/build_ext/ (a scratch
+# copy is used instead). Same QUESTSHOCK_BUILD_IMAGE detection as `engine`.
+engine-win:
+	@if [ -n "$$QUESTSHOCK_BUILD_IMAGE" ]; then \
+		bash build-image/build-engine-win.sh; \
+	else \
+		./run-image.sh bash build-image/build-engine-win.sh; \
+	fi
+
 # Fails with a pointer to extract_assets.sh if the purchased game assets
 # haven't been extracted yet.
 assets:
@@ -49,7 +67,10 @@ assets:
 		exit 1; \
 	fi
 
-dist: engine assets
+# Builds both platforms. `dist-linux`/`dist-win` build just one.
+dist: dist-linux dist-win
+
+dist-linux: engine assets
 	@echo "== Assembling $(DIST_DIR) =="
 	rm -rf "$(DIST_DIR)/systemshock" "$(DIST_DIR)/lib" "$(DIST_DIR)/res" \
 		"$(DIST_DIR)/shaders" "$(DIST_DIR)/run.sh"
@@ -64,6 +85,27 @@ dist: engine assets
 	chmod +x "$(DIST_DIR)/run.sh"
 	@echo "== Done - run $(DIST_DIR)/run.sh to play =="
 
+# Windows counterpart of dist-linux. Unlike dist/, the DLLs sit flat
+# alongside systemshock.exe instead of in a lib/ subdirectory - Windows'
+# default DLL search order already checks the executable's own directory
+# first, so (unlike run.sh's LD_LIBRARY_PATH) run.bat needs no extra
+# wiring for that.
+dist-win: engine-win assets
+	@echo "== Assembling $(DIST_WIN_DIR) =="
+	rm -rf "$(DIST_WIN_DIR)"
+	mkdir -p "$(DIST_WIN_DIR)/res/data" "$(DIST_WIN_DIR)/res/sound"
+	cp "$(ENGINE_OUT_WIN)/systemshock.exe" "$(ENGINE_OUT_WIN)"/*.dll "$(DIST_WIN_DIR)/"
+	cp "$(ENGINE_OUT_WIN)/soundfont.sf2" "$(DIST_WIN_DIR)/res/"
+	cp -a engine/shaders "$(DIST_WIN_DIR)/shaders"
+	cp -a "$(ASSETS_DIR)/data/." "$(DIST_WIN_DIR)/res/data/"
+	cp -a "$(ASSETS_DIR)/sound/." "$(DIST_WIN_DIR)/res/sound/"
+	cp res/run.bat "$(DIST_WIN_DIR)/run.bat"
+	@echo "== Done - run $(DIST_WIN_DIR)/run.bat (or systemshock.exe) to play =="
+
+# Builds both platforms' redistributable archives. `package-linux`/
+# `package-win` build just one.
+package: package-linux package-win
+
 # Builds a versioned, redistributable Linux release tarball at
 # dist/shockolate-<version>-linux-<arch>.tar.gz - everything needed to
 # run except the proprietary game assets (res/GET_ASSETS.txt explains how
@@ -72,7 +114,7 @@ dist: engine assets
 # tag to drive a release. Override with `make package VERSION=1.2.3`, or
 # just run it untagged for a local dev build (gets a 0.0.0-dev+<sha>
 # placeholder version, with a warning).
-package: engine
+package-linux: engine
 	@git config --global --add safe.directory "$$(pwd)" 2>/dev/null || true
 	@V="$$(VERSION="$(VERSION)" ./build-image/version.sh)"; \
 	PKG_NAME="shockolate-$$V-linux-$(ARCH)"; \
@@ -95,6 +137,33 @@ package: engine
 	rm -rf "$(BUILD_DIR)/package"; \
 	echo "Wrote $(DIST_DIR)/$$PKG_NAME.tar.gz"
 
+# Windows counterpart of package-linux: dist/shockolate-<version>-windows-
+# x86_64.zip. Same versioning (build-image/version.sh) and VERSION=
+# override. Needs `zip` on whatever host runs `make package-win` itself
+# (unlike engine-win's own build, packaging isn't run inside the
+# build-image) - see README's Desktop build prerequisites.
+package-win: engine-win
+	@git config --global --add safe.directory "$$(pwd)" 2>/dev/null || true
+	@command -v zip >/dev/null 2>&1 || { echo "PREFLIGHT FAIL: zip not found in PATH" >&2; exit 1; }
+	@V="$$(VERSION="$(VERSION)" ./build-image/version.sh)"; \
+	PKG_NAME="shockolate-$$V-windows-x86_64"; \
+	PKG_STAGE="$(BUILD_DIR)/package/$$PKG_NAME"; \
+	echo "Packaging $$PKG_NAME"; \
+	rm -rf "$$PKG_STAGE"; \
+	mkdir -p "$$PKG_STAGE/res"; \
+	cp "$(ENGINE_OUT_WIN)/systemshock.exe" "$(ENGINE_OUT_WIN)"/*.dll "$$PKG_STAGE/"; \
+	cp -a engine/shaders "$$PKG_STAGE/shaders"; \
+	cp "$(ENGINE_OUT_WIN)/soundfont.sf2" "$$PKG_STAGE/res/"; \
+	cp res/assets/GET_ASSETS.txt "$$PKG_STAGE/res/GET_ASSETS.txt"; \
+	cp res/run.bat "$$PKG_STAGE/run.bat"; \
+	cp LICENSE "$$PKG_STAGE/LICENSE"; \
+	cp engine/LICENSE "$$PKG_STAGE/LICENSE.Shockolate"; \
+	cp NOTICE.txt "$$PKG_STAGE/NOTICE.txt"; \
+	mkdir -p "$(DIST_DIR)"; \
+	(cd "$(BUILD_DIR)/package" && zip -rq "$(CURDIR)/$(DIST_DIR)/$$PKG_NAME.zip" "$$PKG_NAME"); \
+	rm -rf "$(BUILD_DIR)/package"; \
+	echo "Wrote $(DIST_DIR)/$$PKG_NAME.zip"
+
 # Builds the Quest APK (see build-image/build-apk.sh and
 # android/engine-patches/ - engine/ itself is never modified; a patch is
 # applied to a scratch copy at build time instead). Same
@@ -124,7 +193,7 @@ android-studio:
 	./run-image.sh bash build-image/prepare-android-project.sh --host-paths
 
 clean:
-	rm -rf "$(DIST_DIR)" "$(BUILD_DIR)" "$(ENGINE_OUT)" \
+	rm -rf "$(DIST_DIR)" "$(DIST_WIN_DIR)" "$(BUILD_DIR)" "$(ENGINE_OUT)" "$(ENGINE_OUT_WIN)" \
 		engine/build_ext engine/CMakeCache.txt engine/CMakeFiles \
 		engine/cmake_install.cmake engine/Makefile engine/systemshock \
 		engine/src/Libraries/CMakeFiles \