docs: add Build & release section for the unified installer

CLAUDE.md

@@ -186,6 +186,56 @@ A task is done when: code compiles with no clippy warnings; the relevant require
 acceptance criteria are demonstrably met; tests named in `docs/06-test-strategy.md` for that
 phase pass; and docs are updated if behavior or contracts changed.
 
+## Build & release (the unified installer)
+
+Release builds produce **one universal installer** (as **two bundles**: MSI + NSIS) that
+covers every backend from a single command. The Vulkan whisper DLLs are compiled in and
+`vulkan-1.dll` is bundled as a resource; the NPU (OpenVINO) and DirectML runtimes are
+**downloaded on demand** at first use, so they don't need to be built or bundled. There is no
+separate "DirectML build" to merge — the one Vulkan-feature build *is* the universal installer.
+
+**Version bump (4 files, keep them in lockstep):** `package.json`, `src-tauri/Cargo.toml`,
+`src-tauri/tauri.conf.json`, and the `whispassist` entry in `src-tauri/Cargo.lock`. Do **not**
+bump `package-lock.json` — its app version is intentionally `0.0.0` (its only version-looking
+`0.x` string is an unrelated dependency).
+
+**Build command** — run from the repo root with the MSVC environment loaded, targeting the
+dedicated Vulkan build dir so the compile stays incremental (a clean build is much slower):
+
+```sh
+call "C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\VC\Auxiliary\Build\vcvars64.bat"
+set CARGO_TARGET_DIR=C:\wt
+npm run tauri -- build --features vulkan --config src-tauri/tauri.vulkan.conf.json
+```
+
+- `CARGO_TARGET_DIR=C:\wt` is a **persistent Vulkan-build cache**, kept separate from
+  `src-tauri/target` so toggling the `vulkan` feature doesn't force a full rebuild. Reuse it;
+  don't `cargo clean` unless you actually need a from-scratch build.
+- `tauri.vulkan.conf.json` only adds `vulkan-1.dll` to the bundle resources (that DLL lives at
+  `src-tauri/vulkan-1.dll`); everything else comes from the base `tauri.conf.json`.
+- `vcvars64.bat` is required for the native deps (see the build-toolchain memory).
+
+**Output** (under the `C:\wt` target dir), two bundles:
+
+```
+C:\wt\release\bundle\msi\WhispAssist_<ver>_x64_en-US.msi     (~44 MB)
+C:\wt\release\bundle\nsis\WhispAssist_<ver>_x64-setup.exe    (~9 MB)
+```
+
+**Checksums:** generate and verify SHA-256 sums for both bundles, and embed them in
+`RELEASE_NOTES_<ver>.md` (see the 0.4.0/0.5.0 notes for the format):
+
+```sh
+cd C:\wt\release\bundle
+sha256sum msi/WhispAssist_<ver>_x64_en-US.msi nsis/WhispAssist_<ver>_x64-setup.exe | sed 's| \*| |' > SHA256SUMS_<ver>.txt
+sha256sum -c SHA256SUMS_<ver>.txt   # must print OK for both
+```
+
+The bundles and `SHA256SUMS` live in the `C:\wt` build dir, **outside the repo** — only
+`RELEASE_NOTES_<ver>.md` is committed. Bundles are currently **unsigned** (no signing cert in
+`tauri.conf.json`); the release notes carry the SmartScreen "More info → Run anyway" guidance.
+Tagging/pushing a release is outward-facing — do it only when explicitly asked.
+
 ## Guardrails
 
 - Do not add telemetry, analytics, crash reporting, or auto-update phone-home without an ADR