ci(release): build and publish the installer from CI

[Maxaubert]

Closes #26

What

• .github/workflows/release.yml, modelled on Prism and Wind: push to main runs typecheck, lint, prettier and unit tests, requires a NEW package.json version (refuses to overwrite an existing release), builds with electron-builder --publish never, and publishes v<version> with --generate-notes --latest plus a stable-named Filesmith-Setup-x64.exe (so releases/latest/download/Filesmith-Setup-x64.exe always works). Docs, LICENSE and issue-template pushes are ignored.
• Bundled tools on CI: scripts/fetch-binaries.mjs --pinned stages every tool from a pinned, SHA-256-checked official download of the exact version the local v0.5.0 bundle ships (scripts/pinned-tools.mjs). Without --pinned, local behaviour is unchanged.
• scripts/verify-bundle.mjs: fails the build if any bundled tool is missing or does not run (magick encodes and decodes a PNG through the bundled coder modules; ffmpeg, ffprobe, caesiumclt, mutool, 7z, Ghostscript and LibreOffice are smoke-run). It runs on resources/ before packing and on dist/win-unpacked/resources after, and writes file manifests.
• Dry run: PRs touching the release machinery and workflow_dispatch run everything up to the verified installer and upload it (plus manifests) as a workflow artifact; publishing only happens on push to main.
• Version bumped to 0.5.1 so the merge cuts the first CI-built release (v0.5.0 already exists).
• CLAUDE.md: one entry about releases.

Pinned sources

Tool	Version	Source
7-Zip	26.02	ip7z/7zip GitHub release (7zr.exe unpacks the installer)
ImageMagick	7.1.2-29 Q16-HDRI x64 dll	GitHub release, silent Inno install into a staging dir
CaesiumCLT	1.4.0	GitHub release zip
ffmpeg	9.0.2 essentials (gyan.dev)	GyanD/codexffmpeg GitHub release
mutool	1.23.0	mupdf.com archive zip
LibreOffice	26.2.4.2	TDF download archive MSI, silent install into a staging dir
Ghostscript	10.07.1	ArtifexSoftware/ghostpdl-downloads
Real-ESRGAN	v0.2.5.0	xinntao/Real-ESRGAN release zip

Hashes agree with the GitHub release digests and the winget-pkgs manifests; mupdf, Real-ESRGAN and 7-Zip binaries were checked byte-identical to the local bundle.

Unsigned (no certificate configured).

🤖 Generated with Claude Code

[Maxaubert]

Dry run 37227350075: green on the first run, Publish skipped as intended.

• All 9 pinned downloads passed their SHA-256 checks. verify-bundle passed on resources/ and on dist/win-unpacked/resources, with every tool smoke-run (magick encoded and decoded a PNG through the bundled coder modules).
• CI installer: 503.3 MB, against 521.3 MB for the local v0.5.0 build. The CI bundle is 14,610 files, against 14,754 locally. Every file CI is missing is in LibreOffice: the local install also carries the Norwegian UI language pack, de/no dictionaries, 33 crash dumps, __pycache__ and an install log (101.7 MB uncompressed), none of which headless conversion uses. No file exists only on CI.
• Every file outside LibreOffice has the same size in both bundles, except ImageMagick's policy.xml and english.xml. My guess is that the local install kept older config files across an upgrade, which would make the CI copies the fresh ones from the 7.1.2-29 installer. I have not confirmed it.
• Installed the artifact on the dev machine: it reports 0.5.1, verify-bundle passes on the installed tree, and the app launches.