fix(build): normalize non-PEP440 versions, fix .py/compileall ordering, wipe NSIS payload dirs

- build-common.sh: detect_version() normalizes non-PEP440 labels (e.g. 'dev',
  'nightly') to 0.0.0.dev0 so stamping pyproject.toml doesn't break pip install.
- build-common.sh: split .py deletion out of cleanup_site_packages into a new
  compile_and_strip_sources() that runs 'compileall -b' FIRST, then removes
  sources. compileall now fails loud instead of silently no-op'ing.
- build-dist.sh: add missing compile_and_strip_sources call on Linux site-packages
  (previous tarballs shipped empty packages with no .py and no .pyc).
- build-dist-windows.sh: reorder so compile_and_strip_sources runs right after
  cleanup_site_packages, not after .py files have already been deleted.
- installer.nsi: RMDir /r payload dirs (python/, app/, scripts/) and delete
  LedGrab.bat at the top of SecCore before File /r. NSIS File /r MERGES into
  existing dirs, so upgrades left half-old/half-new state that surfaced as
  'version mismatch' or duplicate-package ImportErrors. data/ and logs/ remain
  untouched to preserve user config.

build-dist.sh

@@ -53,6 +53,9 @@ SITE_PACKAGES=$(echo "$VENV_DIR"/lib/python*/site-packages)
 # Clean up with shared function
 cleanup_site_packages "$SITE_PACKAGES" "so" "so"
 
+# Pre-compile and strip .py sources (must happen AFTER cleanup)
+compile_and_strip_sources "$SITE_PACKAGES" "python"
+
 # ── Build frontend ───────────────────────────────────────────
 
 echo "[4/7] Building frontend..."
@@ -63,6 +66,10 @@ build_frontend
 echo "[5/7] Copying application files..."
 copy_app_files
 
+# Pre-compile app source for faster startup (keep .py too — app source
+# is small and easier to debug in-place if a user reports an issue)
+python -m compileall -b -q "$APP_DIR/src" 2>/dev/null || true
+
 # ── Create launcher ──────────────────────────────────────────
 
 echo "[6/7] Creating launcher..."