build(release): ship manual installers

[tnunamak]

Summary

• Builds manual-install packages for Linux, Windows, Apple silicon, and Intel macOS.
• Bundles the local Personal Server, Playwright runner, and Chromium needed by DataConnect.
• Verifies package contents, native architecture, release identity, and optional macOS signatures before publishing.
• Keeps pull request builds read-only and gives write access only to the release publisher after all four platform builds succeed.
• Keeps telemetry and remote protocol services off unless the user configures them.

The workflow does not notarize macOS packages. It signs them only when current Apple signing secrets exist.

Validation

• 557 application tests and 67 Personal Server tests passed.
• Windows path and npm launcher regressions have direct tests.
• Windows installer verification streams large listings with bounded retained output.
• macOS DMG creation retries only the runner's transient resource-busy failure and has a scoped-cleanup regression test.
• A 254 MiB Debian package and finalized 306 MiB AppImage passed package verification.
• The packaged Chromium executable launched successfully.
• Clean installs, frontend build, 78 Rust tests, actionlint, runner compatibility checks, and release workflow tests passed.

Assisted-by: AI