Implement MSIX packaging and Microsoft Store distribution

[AgreeDK]

Current State

Following the Facebook community poll and investigation in #734, the
decision is to distribute OpenSAK on Windows via both channels:

• Microsoft Store (MSIX) — no SmartScreen warning, auto-updates handled
  by Windows, free publisher account
• Direct .exe on GitHub — unchanged, existing PyInstaller build

#564 (paid Windows code signing certificate) is on hold as a result, with
MSIX as the primary path to remove the SmartScreen warning at no ongoing
cost.

Open risk to validate first

QtWebEngine embeds a Chromium runtime, which can trigger extra scrutiny
during Microsoft Store certification. This should be tested with a minimal
prototype before committing further effort — if certification rejects
the app, #564 becomes the fallback again.

Proposed Improvement

Steps

1. Prototype MSIX packaging
   • Package a build of OpenSAK as MSIX (e.g. via pyinstaller output +
     MSIX Packaging Tool, or msix-packaging-tool CLI for CI use)
   • Submit to Microsoft Partner Center as a private/unlisted test
     submission to check certification passes with QtWebEngine included
2. Confirm install path prerequisites (depends on Proper Windows installer with fixed install path (stable Start Menu shortcut across updates) #599)
   • MSIX requires a well-defined install structure; Proper Windows installer with fixed install path (stable Start Menu shortcut across updates) #599's fixed install
     path work should land first or in parallel
3. CI/CD integration
   • Add an MSIX build job to the existing GitHub Actions Windows pipeline
   • Decide submission cadence: automatic per-release vs. manual review
     before each Store submission (Store certification can take hours to
     days, unlike direct .exe releases)
4. Store listing setup
   • Create free Microsoft Store developer account (individual, per 2026
     fee removal)
   • Store listing: description, screenshots, privacy policy link
     (opensak.com)
5. Update documentation and download page
   • opensak.com and README: offer both download options with a short
     explanation of the difference (Store = zero warnings + auto-update;
     direct = same as today)
   • Note that Auto-detect and auto-download correct update asset (no code signing required) #572 (auto-update) remains relevant only for the direct
     .exe track — Store users get updates natively

Verification

• MSIX package installs cleanly on a clean Windows 10/11 VM
• Store certification passes without QtWebEngine-related rejection
• App launches, functions normally, and appears correctly in Start Menu
  under the Store-managed install path
• CI pipeline produces a valid MSIX artifact on tag push

Expected Benefits

Closure criteria

• MSIX build is live in the Microsoft Store
• Both distribution channels documented on opensak.com and in README
• Funding: Microsoft code signing certificate #564 revisited: closed as not-needed if MSIX proves stable, or
  reactivated if Store certification is a blocker

Related issues

• Investigate Microsoft Store distribution (MSIX) as a code-signing-free channel #734 — investigation and community poll (closed, this issue is the
  follow-up implementation)
• Funding: Microsoft code signing certificate #564 — Windows code signing certificate (on hold pending this work)
• Proper Windows installer with fixed install path (stable Start Menu shortcut across updates) #599 — fixed install path (dependency for MSIX packaging structure)
• Auto-detect and auto-download correct update asset (no code signing required) #572 — auto-update for direct-download track (unaffected, still needed)