feat: add Microsoft Store MSIX build track

Stand up an MSIX packaging path for Microsoft Store distribution,
parallel to the existing MSI/NSIS release pipeline. The Store re-signs
MSIX packages on certification, so this channel can go live without
waiting on SignPath/Authenticode code signing.

- src-tauri/gen/windows/: tauri-windows-bundle config + AppxManifest
  template; Identity pinned to the Partner Center package identity
  (var-gg.gitwink), broadFileSystemAccess declared for cross-disk repo
  discovery.
- .github/workflows/store.yml: separate, manually-triggered workflow
  building the x64+arm64 .msixbundle; independent toolchain and output
  dir, no collision with release.yml.
- update/tray/commands: disable the in-app updater for MSIX installs
  since the Store owns updates, mirroring the existing Scoop handling.
- pnpm-workspace.yaml: allow the skia-canvas build script (pulled in by
  tauri-windows-bundle via image-js).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: var-gg

.github/workflows/store.yml

@@ -0,0 +1,69 @@
+# Builds the Microsoft Store MSIX bundle via tauri-windows-bundle.
+#
+# Kept separate from release.yml on purpose: that workflow ships the
+# (SignPath/Authenticode-signed) MSI + NSIS installers to GitHub Releases;
+# this one produces the .msixbundle for manual upload to Partner Center,
+# which the Store re-signs. Different toolchain, different output dir
+# (src-tauri/target/msix/ vs src-tauri/target/release/bundle/) — no collision.
+#
+# Manual trigger only: a Store-submittable package needs the real Partner
+# Center identity filled into src-tauri/gen/windows/bundle.config.json and
+# AppxManifest.xml.template. Run this when a Store submission is due.
+name: MSIX (Microsoft Store)
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  msix:
+    name: Build MSIX bundle
+    runs-on: windows-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: latest
+          run_install: false
+
+      - name: Install Rust (stable, x64 + arm64)
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: x86_64-pc-windows-msvc,aarch64-pc-windows-msvc
+
+      - name: Cache cargo workspace
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: src-tauri
+
+      - name: Install frontend deps
+        run: pnpm install --frozen-lockfile
+
+      # cargo build (the bundler's default runner) does not run Tauri's
+      # beforeBuildCommand, so the frontend must be built into dist/
+      # explicitly before the Rust binary is compiled and packed.
+      - name: Build frontend
+        run: pnpm build
+
+      - name: Install msixbundle-cli
+        run: cargo install msixbundle-cli
+
+      - name: Build MSIX bundle (x64 + arm64)
+        run: pnpm tauri:windows:build --arch x64,arm64 --runner pnpm --verbose
+
+      - name: Upload MSIX bundle
+        uses: actions/upload-artifact@v4
+        with:
+          name: gitwink-msix
+          path: src-tauri/target/msix/*.msixbundle
+          if-no-files-found: error

package.json

@@ -7,7 +7,8 @@
     "dev": "vite",
     "build": "tsc && vite build",
     "preview": "vite preview",
-    "tauri": "tauri"
+    "tauri": "tauri",
+    "tauri:windows:build": "tauri-windows-bundle build"
   },
   "dependencies": {
     "@tauri-apps/api": "^2",
@@ -25,6 +26,7 @@
     "@types/react-dom": "^19.1.6",
     "@vitejs/plugin-react": "^4.6.0",
     "typescript": "~5.8.3",
-    "vite": "^7.0.4"
+    "vite": "^7.0.4",
+    "@choochmeque/tauri-windows-bundle": "^0.1.18"
   }
 }