fix: bundle pandoc+ffmpeg, fix CI pipeline and Windows GitHub build

- Remove package-lock.json from .gitignore so npm ci works in CI
- Refactor main.js: delegate PDF ops to src/main/PDFOperations.js,
  git ops to src/main/GitOperations.js
- getPandocPath(): use bundled binary from resources/bin/ when packaged,
  fall back to dev bin/ or system pandoc in development
- getFFmpegPath(): use ffmpeg-static (asarUnpack) when packaged
- Install ffmpeg-static (v5.3.0, bundled 76MB binary)
- Add scripts/download-tools.js to fetch pandoc binary at build time
  (idempotent, runs on CI before electron-builder)
- electron-builder: add asarUnpack for ffmpeg-static, extraFiles for
  pandoc binary per platform (linux + win32)
- release.yml: switch build-windows to windows-latest runner with native
  NSIS support; add cert decode step; add download-tools step for both
  linux and windows jobs
- Fix lint error: hoist outlinePanelContainer to module scope so
  TabManager methods can reference it without no-undef errors

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.github/workflows/release.yml

@@ -25,6 +25,9 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Download external tools (pandoc)
+        run: node scripts/download-tools.js
+
       - name: Run tests
         run: npm test
 
@@ -56,14 +59,19 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Download external tools (pandoc)
+        run: node scripts/download-tools.js
+
       - name: Run tests
         run: npm test
 
       - name: Decode certificate (if available)
-        if: ${{ secrets.CSC_LINK_BASE64 != '' }}
+        if: ${{ env.CSC_LINK_BASE64 != '' }}
         shell: pwsh
+        env:
+          CSC_LINK_BASE64: ${{ secrets.CSC_LINK_BASE64 }}
         run: |
-          $bytes = [Convert]::FromBase64String("${{ secrets.CSC_LINK_BASE64 }}")
+          $bytes = [Convert]::FromBase64String("$env:CSC_LINK_BASE64")
           [IO.File]::WriteAllBytes("${{ github.workspace }}\code-signing-cert.pfx", $bytes)
           echo "CERT_AVAILABLE=true" >> $env:GITHUB_ENV
 
@@ -77,7 +85,7 @@ jobs:
       - name: Build Windows packages (unsigned)
         if: ${{ env.CERT_AVAILABLE != 'true' }}
         env:
-          CSC_IDENTITY_AUTO_DISCOVERY: false
+          CSC_IDENTITY_AUTO_DISCOVERY: 'false'
         run: npm run build:win-unsigned
 
       - name: Upload Windows artifacts
@@ -86,7 +94,6 @@ jobs:
           name: windows-artifacts
           path: |
             dist/*.exe
-            dist/*-win.zip
             dist/*.zip
           retention-days: 5