Patch Windows server Python custom build commands

ddiff --git a/docs/WINDOWS_SERVER_PYTHON_CUSTOM_BUILD.md b/docs/WINDOWS_SERVER_PYTHON_CUSTOM_BUILD.md
nnew file mode 100644
iindex 0000000..53f8877
---- /dev/null
++++ b/docs/WINDOWS_SERVER_PYTHON_CUSTOM_BUILD.md
@@@ -0,0 +1,16 @@
++# Windows server.vcxproj Python custom build fix
++
++Valve Source SDK's generated server project uses custom build commands that run
++`python` while converting `.nut` script resources into generated headers. On
++GitHub-hosted Windows runners, `actions/setup-python` may succeed while the VPC
++emitted MSBuild custom step still cannot resolve the literal `python` command.
++
++The Windows build script now:
++
++1. creates a deterministic `python.bat`/`python.cmd` shim;
++2. prepends it to PATH;
++3. rewrites generated `.vcxproj` custom build command bodies so `python ...`
++   uses the absolute shim path.
++
++This keeps the generated Source SDK tree disposable while making CI builds
++reliable.
ddiff --git a/tools/build-sdk-windows.ps1 b/tools/build-sdk-windows.ps1
iindex 9b15f72..f5878b9 100644
---- a/tools/build-sdk-windows.ps1
++++ b/tools/build-sdk-windows.ps1
@@@ -101,6 +101,7 @@ exit /b %ERRORLEVEL%
  
    # Put the shim first so custom build steps that literally run `python` find it.
    $env:PATH = "$shimDir;$pyDir;$env:PATH"
++  $script:OpenVibePythonCommand = $bat
    "selected python=$py" | Out-File $log -Append
    "shimDir=$shimDir" | Out-File $log -Append
    "updated PATH=$env:PATH" | Out-File $log -Append
@@@ -145,6 +146,7 @@ where.exe cl | Out-File (Join-Path $LogDir "where-cl.txt")
  where.exe msbuild | Out-File (Join-Path $LogDir "where-msbuild.txt")
  where.exe lib | Out-File (Join-Path $LogDir "where-lib.txt")
  Ensure-PythonOnPath
++Ensure-PythonCommandForMSBuild
  
  
  # Apply OpenVibe source files using Git Bash when available. Skip Linux QuickJS build on Windows.
@@@ -267,6 +269,45 @@ function Sort-PreferredConfigs($pairs, [string]$projName) {
    return @($preferred)
  }
  
++
++function Patch-GeneratedPythonCustomBuildCommands {
++  if (-not $script:OpenVibePythonCommand -or !(Test-Path $script:OpenVibePythonCommand)) {
++    Ensure-PythonCommandForMSBuild
++  }
++
++  $py = $script:OpenVibePythonCommand
++  Say "patching generated vcxproj python custom build commands to $py"
++  $patchLog = Join-Path $LogDir "python-vcxproj-patches.txt"
++  "python command=$py" | Out-File $patchLog
++
++  $projects = @(Get-ChildItem -Path $Src -Recurse -File -Filter "*.vcxproj" -ErrorAction SilentlyContinue)
++  foreach ($proj in $projects) {
++    $text = Get-Content -Raw $proj.FullName
++    $before = $text
++
++    # XML command bodies can contain python at line start, after XML tags, or after &&.
++    # Replace only executable tokens, preserving surrounding whitespace/tags.
++    $text = [regex]::Replace($text, '(?im)(^|[>`r`n])([ `t]*)python(\.exe)?([ `t]+)', {
++      param($m)
++      return $m.Groups[1].Value + $m.Groups[2].Value + '"' + $py + '"' + $m.Groups[4].Value
++    })
++    $text = [regex]::Replace($text, '(?i)(&&[ `t]*)python(\.exe)?([ `t]+)', {
++      param($m)
++      return $m.Groups[1].Value + '"' + $py + '"' + $m.Groups[3].Value
++    })
++    $text = [regex]::Replace($text, '(?i)(&&[ `t]*)python(\.exe)?([ `t]+)', {
++      param($m)
++      return $m.Groups[1].Value + '"' + $py + '"' + $m.Groups[3].Value
++    })
++
++    if ($text -ne $before) {
++      Set-Content -Encoding utf8 -Path $proj.FullName -Value $text
++      "patched $($proj.FullName)" | Out-File $patchLog -Append
++    }
++  }
++}
++
++
  function Invoke-MSBuildProject([System.IO.FileInfo]$proj, [string]$label) {
    Say "building $label project=$($proj.FullName)"
    $pairs = Get-ProjectConfigs $proj.FullName
@@@ -393,6 +434,8 @@ $serverProject = $serverProjects |
                FullName |
    Select-Object -First 1
  
++Patch-GeneratedPythonCustomBuildCommands
++
  Build-SourceSdkDependencyProjects
  
  $beforeBuild = Get-Date