fix(install): ask for UAC approval to install ARM64 build tools

A non-elevated Windows ARM64 install threw "run setup-hermes.ps1 in an
Administrator PowerShell" whenever Visual Studio ARM64 C++/Clang were
missing. Interactive runs now launch the signed VS installer through a
UAC prompt; CI, ssh and scheduled runs keep the explicit instruction.

scripts/windows-build-deps.ps1

@@ -119,9 +119,13 @@ function Initialize-HermesArm64BuildTools {
     if (-not $vs -or -not $clangPath) {
         $identity = [Security.Principal.WindowsIdentity]::GetCurrent()
         $principal = New-Object Security.Principal.WindowsPrincipal($identity)
-        if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
-            throw 'ARM64 C++ or Clang build tools are missing. Run setup-hermes.ps1 once in an Administrator PowerShell to install them.'
-        }
+        $elevated = $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
+        # A UAC prompt needs someone at the desktop; CI, ssh and scheduled
+        # runs would block on it, so they keep the explicit instruction.
+        $canPrompt = [Environment]::UserInteractive -and -not $env:CI -and -not $env:GITHUB_ACTIONS -and
+            -not $env:SSH_CONNECTION -and -not $env:SSH_CLIENT
+        $needsAdmin = 'ARM64 C++ or Clang build tools are missing. Run setup-hermes.ps1 once in an Administrator PowerShell to install them.'
+        if (-not $elevated -and -not $canPrompt) { throw $needsAdmin }
         $installer = Join-Path $buildRoot 'vs-buildtools.exe'
         Write-Host '-> Installing Visual Studio Build Tools (ARM64 C++ and Clang) to compile dependencies that have no ARM64 Windows wheel (such as cryptography).'
         Write-Host '-> This downloads several GB and can take 20+ minutes. The Visual Studio installer shows its progress in its own window.'
@@ -139,7 +143,16 @@ function Initialize-HermesArm64BuildTools {
             '--add', 'Microsoft.VisualStudio.Component.VC.Llvm.Clang'
         )
         if ($vs) { $installArgs = @('modify', '--installPath', ('"' + $vs + '"')) + $installArgs }
-        $install = Start-Process -FilePath $installer -ArgumentList $installArgs -Wait -PassThru
+        if ($elevated) {
+            $install = Start-Process -FilePath $installer -ArgumentList $installArgs -Wait -PassThru
+        } else {
+            Write-Host '-> Windows will ask for administrator approval to install them.'
+            try {
+                $install = Start-Process -FilePath $installer -ArgumentList $installArgs -Verb RunAs -Wait -PassThru
+            } catch {
+                throw "Administrator approval was declined or unavailable. $needsAdmin"
+            }
+        }
         if ($install.ExitCode -notin @(0, 3010)) { throw "Visual Studio installation failed: $($install.ExitCode)" }
         $vs = Get-HermesArm64VisualStudio
         if (-not $vs) { throw 'ARM64 C++ build tools remain unavailable. Restart Windows if the installer requested it.' }

website/docs/reference/package-management.md

@@ -221,7 +221,9 @@ On ARM64, PM prepares Visual Studio C++ tools, Clang, native Rust, and static
 OpenSSL development libraries before every dependency build from a checkout:
 setup, `activate.ps1`, `install.ps1`, `hermes update`, and repair alike. It
 reuses existing installations and installs missing prerequisites. Missing
-Visual Studio components require an Administrator PowerShell. OpenSSL uses
+Visual Studio components need administrator rights: an interactive install
+asks through a UAC prompt, while CI, ssh and scheduled runs need an
+Administrator PowerShell. OpenSSL uses
 vcpkg's `arm64-windows-static-md` triplet. A damaged shared installation
 produces a repair error, not automatic deletion. Compiler and OpenSSL
 environment variables apply only to PM's dependency build, never to your shell.