feat(template): install HardeningKitty audit view

setup.py

@@ -55,6 +55,8 @@ REQUIRED_VENDOR_FILES = (
 
 # A staged/installed directory stores the vendor files at its root (NOT /vendor).
 RUNTIME_FILES = ('runner.ps1', 'audit_config.json')
+CONSOLE_TEMPLATE = 'console-templates/host_audit_hardeningkitty_hardeningkitty.html'
+_IS_WINDOWS = os.name == 'nt'
 # Old package versions included this file. It is no longer required or trusted.
 LEGACY_FILES = ('package-manifest.json',)
 
@@ -200,6 +202,7 @@ def install():
         # A security operation can change ACLs. Verify readability and all
         # checksums AFTER the final ACL change, before replacing a working install.
         _verify_vendor(staging, runtime=True)
+        _install_console_template(source)
         mkdirs(REPORT_ROOT)
         _secure_directory(REPORT_ROOT)
         if isdir(INSTALL_ROOT):
@@ -224,6 +227,29 @@ def install():
           (manifest['upstream_commit'], len(manifest['files'])))
 
 
+def _install_console_template(source):
+    """Install the WAPT Console view on Windows using WAPT setuphelpers paths."""
+    if not _IS_WINDOWS:
+        return
+    template_source = makepath(source, *CONSOLE_TEMPLATE.split('/'))
+    if not isfile(template_source):
+        raise RuntimeError('WAPT Console audit template is missing from the package.')
+    # WAPT setuphelpers exposes programfiles32 as the x86 Program Files path.
+    template_dir = makepath(programfiles32, 'wapt', 'templates')
+    mkdirs(template_dir)
+    target = makepath(template_dir, os.path.basename(CONSOLE_TEMPLATE))
+    staged = target + '.new-' + uuid.uuid4().hex
+    try:
+        # setuphelpers filecopyto stages on the destination volume; os.replace
+        # swaps the template atomically and leaves an existing file intact if
+        # copying fails.
+        filecopyto(template_source, staged)
+        os.replace(staged, target)
+    finally:
+        if isfile(staged):
+            remove_file(staged)
+
+
 def uninstall():
     if os.path.lexists(INSTALL_ROOT):
         if not _owned_install(INSTALL_ROOT):