feat(packaging): all-platform builds with GitHub Releases

Closes the gap from the previous handoff: `npm run dist:all` now
produces Linux .deb/AppImage/snap, Windows NSIS/portable/zip, and
macOS dmg/zip artifacts. `.github/workflows/release.yml` builds all
three on tag push (v*) and attaches the union to a GitHub Release.

Bug fix in the same commit (would have broken any packaged build):

* `build.files` was `["src/**/*", ...]` — shipped `src/renderer/`
  .tsx dev source into the asar. Replaced with a whitelist
  (`src/main/**/*`, `src/preload.js`, `src/plugins/**/*`,
  `package.json`) and moved the built renderer to
  `build.extraResources` (`dist/renderer` -> `renderer/`).

* `src/main/window/index.js` now uses `process.resourcesPath` when
  `app.isPackaged` is true, plus a friendly error if the renderer is
  missing. Verified by extracting the .AppImage and launching the
  binary — main process logs
  `Production mode — loading .../resources/renderer/index.html`.

New in `package.json` build config:

* `mac.target`: dmg + zip for x64 and arm64; `darkModeSupport: true`,
  `hardenedRuntime: false`, `gatekeeperAssess: false`,
  `entitlements: null`. `mac.identity: null` retained (unsigned).
* `publish`: GitHub Releases provider. CI overrides with
  `--publish=never`.

Known limitations (intentional follow-ups, not blockers):

* No `assets/icon.icns` — macOS app uses the default Electron icon.
  This box lacks `iconutil`/`png2icns`; generating a proper .icns is
  a one-line follow-up.
* No code signing — Windows SmartScreen will warn, macOS Gatekeeper
  will quarantine. `CSC_LINK_BASE64`/`CSC_KEY_PASSWORD` secrets are
  already wired in the Windows job for when the cert is added.
* No auto-update — user decision. The `publish` block writes the
  metadata that a future `electron-updater` integration will consume.

Verified on this Linux box:

* `npm run build:renderer` then `npm run build:linux` — produced
  AppImage (291M), deb (220M), snap (245M).
* `resources/app.asar` has 0 `src/renderer/*` entries (was the
  pre-fix bug). 44 .tsx files remain in asar — all from
  `node_modules/@hookform/resolvers` and `node_modules/immer` test
  fixtures, not our code.
* Extracted `squashfs-root/resources/renderer/index.html` exists and
  is what `window/index.js` loads.
* Binary runs for >12s without crashing — `loadFile` resolves
  `process.resourcesPath/renderer/index.html` correctly.

Tests: 306/306 pass. No regressions.

Plan doc: docs/plans/2026-06-06-packaging-all-platforms.md (the
task-by-task execution guide I followed; included for traceability).

src/main/window/index.js

@@ -24,7 +24,11 @@ function createMainWindow() {
   });
 
   // Dev (Vite): load the running dev server so .tsx is transformed on the fly.
-  // Production: load the built dist/renderer/index.html (Vite output).
+  // Production (running from dist/ directly): load the built renderer at the
+  //   relative path from this file.
+  // Production (packaged installer build): the renderer ships under
+  //   process.resourcesPath/renderer (configured via build.extraResources in
+  //   package.json) — not inside the asar.
   // VITE_DEV_SERVER_URL is set by `npm run dev` via cross-env.
   // app.isPackaged is set by electron-builder for installer builds.
   const devServerUrl = process.env.VITE_DEV_SERVER_URL;
@@ -32,9 +36,24 @@ function createMainWindow() {
     console.log('[WINDOW] Dev mode — loading', devServerUrl);
     win.loadURL(devServerUrl);
   } else {
-    const prodPath = path.join(__dirname, '../../dist/renderer/index.html');
-    console.log('[WINDOW] Production mode — loading', prodPath);
-    win.loadFile(prodPath);
+    const rendererIndex = app.isPackaged
+      ? path.join(process.resourcesPath, 'renderer', 'index.html')
+      : path.join(__dirname, '../../dist/renderer/index.html');
+
+    if (app.isPackaged) {
+      try {
+        fs.accessSync(rendererIndex);
+      } catch {
+        console.error(
+          '[WINDOW] Renderer not found at',
+          rendererIndex,
+          '— did you run `npm run build:renderer` before packaging?',
+        );
+      }
+    }
+
+    console.log('[WINDOW] Production mode — loading', rendererIndex);
+    win.loadFile(rendererIndex);
   }
 
   // Show window only after content is ready — avoids blank flash