feat: publish to WinGet

[bsg62]

Add WinGet as a distribution channel, publishing WebCodr.jwtd to microsoft/winget-pkgs as a portable-zip package.

What changed

• New windows zip archive. WinGet cannot consume tar.gz, so the windows targets now ship an additional .zip built from a dedicated windows-only build (jwtd-windows) with identical settings — its jwtd.exe is byte-for-byte the same binary as the windows tar.gz. The zip carries its own archive id (jwtd-zip) so Scoop stays pinned to the tar.gz (scoops.ids: [jwtd]), and SBOMs stay scoped to the tar.gz set since the zip wraps an already-cataloged binary.
• Release contract is now eight archives (six tar.gz + two windows .zip), one checksums.txt, six SBOMs. Both zips are byte-reproducible, so they join the strict byte-for-byte verification tier.
• Hand-templated manifests in winget/ (WebCodr.jwtd.yaml, .installer.yaml, .locale.en-US.yaml) with VERSION / SHA256_WINDOWS_{AMD64,ARM64} placeholders — the source of truth for the manual first submission. InstallerType: zip + NestedInstallerType: portable → jwtd.exe.
• update-winget CI job. Gated to stable releases, after the release job. Verifies installers against the signed checksums.txt, installs a version-pinned + sha256-verified komac, and opens the moderated winget-pkgs PR from the webcodr fork via the GitHub API (no giant-repo clone).
• Docs + TestWinGetInvariants enforcing the portable-zip contract and the gated, checksum-verified, pinned-komac job.

Manual setup required before this channel works end-to-end

The update-winget job will fail on the first stable release until all three of these exist. None can be done from this PR — they involve accounts, secrets, and a moderated external repo.

1. Fork winget-pkgs

Fork microsoft/winget-pkgs into the webcodr account (→ webcodr/winget-pkgs, default settings). The job hardcodes KOMAC_FORK_OWNER=webcodr and opens its PR from that fork. One-time.

2. Create the WINGET_TOKEN secret

• Generate a GitHub PAT (classic) with public_repo scope — it pushes branches to webcodr/winget-pkgs and opens PRs against microsoft/winget-pkgs.
• Add it to this repo → Settings → Secrets and variables → Actions → New repository secret, named exactly WINGET_TOKEN.

3. Seed the first submission manually

komac's update can only update an existing WebCodr.jwtd package — it can't create one, so the first version is submitted by hand from the winget/ templates:

• Cut a real stable release first (so the jwtd-windows-{amd64,arm64}.zip assets and their checksums.txt hashes exist).
• Fill the three winget/ manifests: replace VERSION and both SHA256_WINDOWS_* placeholders with the values from that release's signed checksums.txt.
• Submit to microsoft/winget-pkgs under manifests/w/WebCodr/jwtd/<version>/ — via komac submit / wingetcreate submit pointing at the two zip URLs, or a manual PR. New packages are moderated, so expect a review round.

Validation heads-up: winget-pkgs runs the binary in a sandbox during validation. jwtd with no args drops into the interactive readline prompt; if the sandbox hangs on that, expect a manual-review nudge from the moderators.

Once the package exists upstream and the fork + secret are in place, every future stable release auto-submits via update-winget. Prereleases are skipped (if: needs.validate.outputs.prerelease == 'false').

🤖 Generated with Claude Code