fix(build): normalize non-PEP440 versions, fix .py/compileall ordering, wipe NSIS payload dirs

- build-common.sh: detect_version() normalizes non-PEP440 labels (e.g. 'dev',
  'nightly') to 0.0.0.dev0 so stamping pyproject.toml doesn't break pip install.
- build-common.sh: split .py deletion out of cleanup_site_packages into a new
  compile_and_strip_sources() that runs 'compileall -b' FIRST, then removes
  sources. compileall now fails loud instead of silently no-op'ing.
- build-dist.sh: add missing compile_and_strip_sources call on Linux site-packages
  (previous tarballs shipped empty packages with no .py and no .pyc).
- build-dist-windows.sh: reorder so compile_and_strip_sources runs right after
  cleanup_site_packages, not after .py files have already been deleted.
- installer.nsi: RMDir /r payload dirs (python/, app/, scripts/) and delete
  LedGrab.bat at the top of SecCore before File /r. NSIS File /r MERGES into
  existing dirs, so upgrades left half-old/half-new state that surfaced as
  'version mismatch' or duplicate-package ImportErrors. data/ and logs/ remain
  untouched to preserve user config.

installer.nsi

@@ -87,6 +87,18 @@ Section "!${APPNAME} (required)" SecCore
 
   SetOutPath "$INSTDIR"
 
+  ; Wipe prior payload dirs before extracting. NSIS File /r MERGES files
+  ; on top of existing ones — on an upgrade, stale .pyc/.pyd from the old
+  ; version (and any files removed or renamed since) would survive,
+  ; producing a half-old/half-new install that presents as "version
+  ; mismatch" or "duplicate package" ImportErrors at runtime.
+  ; IMPORTANT: only touch payload dirs — never $INSTDIR\data or
+  ; $INSTDIR\logs (user config must be preserved across upgrades).
+  RMDir /r "$INSTDIR\python"
+  RMDir /r "$INSTDIR\app"
+  RMDir /r "$INSTDIR\scripts"
+  Delete "$INSTDIR\LedGrab.bat"
+
   ; Copy the entire portable build
   File /r "build\LedGrab\python"
   File /r "build\LedGrab\app"