fix(build): normalize non-PEP440 versions, fix .py/compileall ordering, wipe NSIS payload dirs

- build-common.sh: detect_version() normalizes non-PEP440 labels (e.g. 'dev',
  'nightly') to 0.0.0.dev0 so stamping pyproject.toml doesn't break pip install.
- build-common.sh: split .py deletion out of cleanup_site_packages into a new
  compile_and_strip_sources() that runs 'compileall -b' FIRST, then removes
  sources. compileall now fails loud instead of silently no-op'ing.
- build-dist.sh: add missing compile_and_strip_sources call on Linux site-packages
  (previous tarballs shipped empty packages with no .py and no .pyc).
- build-dist-windows.sh: reorder so compile_and_strip_sources runs right after
  cleanup_site_packages, not after .py files have already been deleted.
- installer.nsi: RMDir /r payload dirs (python/, app/, scripts/) and delete
  LedGrab.bat at the top of SecCore before File /r. NSIS File /r MERGES into
  existing dirs, so upgrades left half-old/half-new state that surfaced as
  'version mismatch' or duplicate-package ImportErrors. data/ and logs/ remain
  untouched to preserve user config.

build-dist-windows.sh

@@ -273,6 +273,12 @@ rm -rf "$SITE_PACKAGES"/pythonwin 2>/dev/null || true
 rm -f "$SITE_PACKAGES"/PyWin32.chm 2>/dev/null || true
 find "$SITE_PACKAGES/winrt" -name "*.pyi" -delete 2>/dev/null || true
 
+# Pre-compile and strip .py sources. MUST run AFTER cleanup (so we don't
+# waste work compiling files about to be deleted). Uses host python —
+# PYTHON_VERSION above must match the embedded Python major.minor or
+# the generated .pyc will ImportError on the target.
+compile_and_strip_sources "$SITE_PACKAGES" "python"
+
 WHEEL_COUNT=$(ls "$WHEEL_DIR"/*.whl 2>/dev/null | wc -l)
 echo "  Installed $WHEEL_COUNT packages"
 
@@ -286,10 +292,9 @@ build_frontend
 echo "[8/9] Copying application files..."
 copy_app_files
 
-# Pre-compile Python bytecode for faster startup
-echo "  Pre-compiling Python bytecode..."
+# Pre-compile app source for faster startup (keep .py too — app source
+# is small and easier to debug in-place if a user reports an issue)
 python -m compileall -b -q "$APP_DIR/src" 2>/dev/null || true
-python -m compileall -b -q "$SITE_PACKAGES" 2>/dev/null || true
 
 # ── Create launcher ──────────────────────────────────────────