feat(packaging): native installers via Briefcase + CI/CD

Add cross-platform packaging with BeeWare Briefcase:
- Windows MSI (WiX via dotnet-tool) and ZIP artifacts.
- macOS DMG for arm64, ad-hoc signed; optional Developer ID notarization.
- Linux system package (.deb/.rpm) for x86_64.
- pyproject.toml Briefcase config with min_os_version 13.0 on macOS and
  pip constraints exported from uv.lock for reproducible installs.
- GitHub Actions release workflow (tag or workflow_dispatch) with optional
  code-signing gates for Windows (signtool/PFX) and macOS (notarytool).
- CI: actionlint workflow validation, uv audit dependency audit, Briefcase
  ZIP smoke build.
- Dependabot for GitHub Actions and uv with a 7-day cooldown.
- Pre-commit migrated to pre-commit-uv.
- CHANGELOG.md following Keep a Changelog 1.1.0.
- Drop legacy PyInstaller / Nuitka / Inno Setup / NSIS build scripts.

Author: richardkoehler

.github/dependabot.yml

@@ -0,0 +1,21 @@
+version: 2
+updates:
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "python"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "ci"

.github/workflows/ci.yml

@@ -3,12 +3,41 @@ name: CI - Lint and Type Check
 on:
   push:
     branches:
-      - "**"
+      - main
   pull_request:
     branches:
       - "**"
 
 jobs:
+  workflow-lint:
+    name: Workflow lint (actionlint)
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Lint GitHub workflow files
+        uses: rhysd/actionlint@v1.7.8
+
+  dependency-audit:
+    name: Dependency audit (uv audit)
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57
+        with:
+          python-version: "3.14"
+          enable-cache: true
+
+      - name: Audit dependencies for vulnerabilities
+        run: |
+          uv audit
+
   lint:
     name: Lint
     runs-on: ubuntu-latest
@@ -66,8 +95,7 @@ jobs:
         include:
           - os: ubuntu-latest
           - os: windows-latest
-          # Apple Silicon (arm64); see https://github.com/actions/runner-images
-          - os: macos-14
+          - os: macos-latest
 
     steps:
       - name: Checkout repository
@@ -99,3 +127,36 @@ jobs:
           QT_QPA_PLATFORM: offscreen
         run: |
           uv run pytest --cov-fail-under=48
+
+  package-briefcase-zip:
+    name: Package Briefcase ZIP (Windows)
+    runs-on: windows-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57
+        with:
+          python-version: "3.14"
+          enable-cache: true
+
+      - name: Sync dependencies (incl. build / Briefcase)
+        run: |
+          uv sync --locked --dev --group build
+
+      - name: Briefcase create / build / package (zip)
+        env:
+          QT_QPA_PLATFORM: offscreen
+        run: |
+          uv run briefcase create windows app
+          uv run briefcase build windows app
+          uv run briefcase package windows -p zip
+
+      - name: Upload Briefcase ZIP artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: briefcase-windows-zip-${{ github.sha }}
+          path: dist/
+          if-no-files-found: warn