fix: bundle pandoc+ffmpeg, fix CI pipeline and Windows GitHub build

- Remove package-lock.json from .gitignore so npm ci works in CI
- Refactor main.js: delegate PDF ops to src/main/PDFOperations.js,
  git ops to src/main/GitOperations.js
- getPandocPath(): use bundled binary from resources/bin/ when packaged,
  fall back to dev bin/ or system pandoc in development
- getFFmpegPath(): use ffmpeg-static (asarUnpack) when packaged
- Install ffmpeg-static (v5.3.0, bundled 76MB binary)
- Add scripts/download-tools.js to fetch pandoc binary at build time
  (idempotent, runs on CI before electron-builder)
- electron-builder: add asarUnpack for ffmpeg-static, extraFiles for
  pandoc binary per platform (linux + win32)
- release.yml: switch build-windows to windows-latest runner with native
  NSIS support; add cert decode step; add download-tools step for both
  linux and windows jobs
- Fix lint error: hoist outlinePanelContainer to module scope so
  TabManager methods can reference it without no-undef errors

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

package.json

@@ -22,6 +22,7 @@
     "build:local": "electron-builder --linux --win",
     "dist": "electron-builder --publish=never",
     "dist:all": "electron-builder -mwl",
+    "download-tools": "node scripts/download-tools.js",
     "generate-icons": "node scripts/generate-icons.js"
   },
   "keywords": [
@@ -74,6 +75,7 @@
     "docx4js": "^3.3.0",
     "dompurify": "^3.3.1",
     "electron-store": "^10.1.0",
+    "ffmpeg-static": "^5.3.0",
     "highlight.js": "^11.11.1",
     "html2pdf.js": "^0.14.0",
     "marked": "^17.0.3",
@@ -109,6 +111,10 @@
       "node_modules/**/*",
       "package.json"
     ],
+    "asarUnpack": [
+      "node_modules/ffmpeg-static/**"
+    ],
+    "extraFiles": [],
     "fileAssociations": [
       {
         "ext": "md",
@@ -160,7 +166,11 @@
       "artifactName": "${productName}-${version}-${arch}.${ext}",
       "requestedExecutionLevel": "asInvoker",
       "legalTrademarks": "Copyright (C) 2024-2025 ConcreteInfo",
-      "verifyUpdateCodeSignature": false
+      "verifyUpdateCodeSignature": false,
+      "signAndEditExecutable": false,
+      "extraFiles": [
+        { "from": "bin/win32/pandoc.exe", "to": "bin/pandoc.exe" }
+      ]
     },
     "nsis": {
       "oneClick": false,
@@ -186,7 +196,10 @@
         "rpm"
       ],
       "category": "Utility",
-      "maintainer": "ConcreteInfo <amit.wh@gmail.com>"
+      "maintainer": "ConcreteInfo <amit.wh@gmail.com>",
+      "extraFiles": [
+        { "from": "bin/linux/pandoc", "to": "bin/pandoc" }
+      ]
     },
     "deb": {
       "depends": [