Prepare Microsoft Store MSIX release 1.1.1

[danielss-dev]

Summary

• add a verified x64 packaged-classic MSIX path using Microsoft's MakeAppx tooling
• parameterize the manifest with exact Partner Center identity values and fail closed on the development identity
• add a manual workflow that produces an unsigned .msix plus the recommended .msixupload for Partner Center to sign
• make Microsoft Store builds use Store-managed updates instead of Strand's direct GitHub updater
• retain the signed offline-WebView2 MSI/EXE path as a certificate-dependent fallback
• bump the candidate version to 1.1.1 and add Partner Center copy, privacy/user-content policies, sanitized screenshots, and in-app inappropriate-content reporting

Verification

• frontend: 45 test files / 302 tests passed; TypeScript passed
• Rust: cargo check -p strand-core -p strand-tauri passed; the earlier branch CI run also passed Rust tests and Clippy
• fresh development MSIX: 17,656,211 bytes, SHA-256 6D13C5B4E8CD7A705148EBA7B97EE1DB2615FFD46E82B0CF3DD5F9FCA7947D7F
• MakeAppx completed full semantic validation for both development and production-mode identity substitution
• a copied package was signed with a temporary local test certificate, registered as dev.danielss.strand.msix.test_1.1.1.0_x64__94yh9fqhspgzm, and launched a responsive Strand window from its protected WindowsApps path
• the exact test process, package, and certificate were removed; all touched certificate stores audited clean
• .msixupload rehearsal contains exactly the expected MSIX
• release security, MSI fallback policy, MSIX policy, and whitespace checks passed

Remaining external gates

• create Strand as an MSIX or PWA app in Partner Center (the existing EXE/MSI product does not provide the MSIX package identity)
• copy the exact Package/Identity/Name, Package/Identity/Publisher, and Package/Properties/PublisherDisplayName values into the manual MSIX workflow
• run the workflow for the exact release tag, upload its .msixupload, and complete Partner Center validation/certification
• install/update/uninstall the Store-signed result on a clean Windows 11 x64 machine and complete the open trademark/privacy approvals

No CA-backed Windows certificate is required for the preferred MSIX route; Microsoft re-signs it after certification. The MSI/EXE fallback remains blocked on an external publisher certificate.