Phase 1: RioGamepad virtual HID driver (KMDF + VHF) + C# report packer

Author the custom virtual HID gamepad that replaces vJoy, and pin its wire
format on both sides. Builds clean to RioGamepad.sys against the EWDK
(KMDF 1.15 + VHF, x64, warnings-as-errors).

driver/RioGamepad/:
- ReportDescriptor.h: 6x16-bit axes (X,Y,Z,Rx,Ry,Rz), one 4-direction hat with
  null state, and 96 buttons — the legacy vJoy layout. 25-byte input report.
- Device.c/Driver.c: KMDF root-enumerated device that creates the VHF virtual HID
  device (VhfCreate in DeviceAdd, VhfStart in D0Entry, VhfDelete on cleanup) and
  exposes a device interface + IOCTL_RIO_SUBMIT_REPORT that forwards the caller's
  report bytes to VhfReadReportSubmit. Thin relay: no report logic in the kernel.
- Public.h: device-interface GUID, IOCTL, and the report byte layout shared with
  the C# client. RioGamepad.inf + build.cmd (EWDK build, catalog/sign disabled).

src/RioJoy.Core/Hid/RioHidReport.cs: packs AxisOutputs + hat + 96 buttons into
the exact 25-byte report (LE axes, hat nibble with 0x0F=centered, button bitmap).
13 new xUnit tests (136 total).

Remaining (deploy-side): test-sign + pnputil install + verify in joy.cpl, and
wire the real DeviceIoControl feeder sink (replacing NullJoystickSink). The
EWDK's in-build catalog task (DrvCat) can't load Microsoft.Kits.Logger on this
image, so the .cat is produced with inf2cat/signtool at install time instead.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/PLAN.md

@@ -106,12 +106,20 @@ tray menu is always available.
   (tray app); `driver/` placeholder for the WDK project.
 - This plan + [PROTOCOL.md](PROTOCOL.md).
 
-### Phase 1 — Virtual HID driver (highest risk; do first)
+### Phase 1 — Virtual HID driver — compiling ✅ (sign/install pending)
+Implemented in [`driver/RioGamepad/`](../driver/RioGamepad/); builds to
+`RioGamepad.sys` against the EWDK (KMDF 1.15 + VHF, x64, warnings-as-errors).
 - KMDF + VHF virtual HID gamepad: report descriptor = 6×16-bit axes, 1 hat,
-  96 buttons.
-- Control device + custom IOCTL → `VhfReadReportSubmit`.
-- Test harness (throwaway C#) wiggles axes/buttons; verify in `joy.cpl`.
-- Test-signing setup for the cabinets.
+  96 buttons ([`ReportDescriptor.h`](../driver/RioGamepad/ReportDescriptor.h)).
+- Device interface + custom `IOCTL_RIO_SUBMIT_REPORT` → `VhfReadReportSubmit`; the
+  driver is a thin relay, with the 25-byte report layout pinned in
+  [`Public.h`](../driver/RioGamepad/Public.h).
+- C# side of the contract: `RioJoy.Core.Hid.RioHidReport` packs axes/hat/buttons
+  into that exact report (unit-tested). Replaces the throwaway test harness idea.
+- ⏳ **Remaining (Phase 6 / on-cabinet):** test-sign + `pnputil` install + verify
+  in `joy.cpl`; wire the real `DeviceIoControl` feeder sink (replacing
+  `NullJoystickSink`). The EWDK's in-build catalog/sign tasks are bypassed; the
+  `.cat` is made with `inf2cat`/`signtool` at install time.
 
 ### Phase 2 — Serial + RIO protocol core (`RioJoy.Core`) — code-complete ✅
 Implemented in `src/RioJoy.Core/Protocol` + `Serial`, covered by