Publish the Windows app as MSIX through the Microsoft Store

## Problem

Draft Omen's Windows release is currently an unsigned frozen executable distributed through GitHub Releases. SignPath Foundation declined the project, so the signing and direct-download path described by this ticket is no longer available.

The Windows app should instead be distributed as an MSIX through the Microsoft Store. The maintainer has a Microsoft developer account but no Windows machine, so package creation, validation, and repeatable release work must run on hosted Windows infrastructure.

## Goal

Publish Draft Omen as a free x64 MSIX app in the Microsoft Store, with the package built and validated on GitHub-hosted Windows runners. Complete the first Store publication through Partner Center, then automate later Store submissions from protected GitHub Actions release jobs. No maintainer-owned Windows machine or production code-signing certificate should be required for building or submitting releases; acquisition from the live Store remains a manual check on an externally available Windows 11 device.

## Confirmed delivery path

1. In Partner Center, create an **MSIX or PWA app**, reserve the product name, and obtain the Store-assigned package identity and publisher values.
2. Package the existing frozen PySide/Nuitka desktop executable as a full-trust Windows Desktop MSIX. The Store Developer CLI does not provide a Python packaging preset, so the repository must define the manifest, assets, layout, version mapping, and MakeAppx-based packaging explicitly.
3. Build, package, validate, test-sign for CI installation only, install, launch, and remove the package on hosted Windows infrastructure. MakeAppx produces the `.msix`; a separate deterministic archive step produces the recommended `.msixupload` submitted to Partner Center. The production Store package does not need a private signing certificate because Microsoft signs published MSIX packages after certification.
4. Complete the first Partner Center submission interactively, including pricing and availability, properties, age rating, package, Store listing, screenshots, and certification notes. Microsoft documents that GitHub Actions update automation requires the app to be already published and live.
5. After the first release is live, use the Microsoft Store Developer CLI from a protected GitHub Actions environment to submit updates. The current automation supports free products and requires a Partner Center-linked Microsoft Entra application plus tenant ID, seller ID, client ID, and client secret.
6. Treat Partner Center certification and publication as asynchronous external release gates. Certification can take up to three business days; a successful submission is complete only when Partner Center reports the release **In the Store**.

## Scope

- Partner Center product reservation, package identity, free/public distribution settings, listing requirements, and first-submission bootstrap.
- An x64 full-trust desktop MSIX manifest, Store assets, deterministic four-part package versioning, package layout, and MakeAppx-based assembly.
- Hosted Windows package validation and installed-package launch/removal smoke tests using the existing deterministic mock workflow.
- First manual Store submission, certification, publication, and an explicit manual boundary for acquiring the live Store package on an external Windows 11 device.
- Protected GitHub Actions submission of later tagged releases through the Microsoft Store Developer CLI, with submission status visible to release operators.
- Removal of SignPath and unsigned public Windows-download instructions while preserving unrelated macOS, PyPI, and Homebrew release paths.

## Out of scope

- SignPath, a separately purchased production code-signing certificate, or direct public distribution of Windows EXE/MSI installers.
- A Windows application redesign or changes to Draft Omen's draft, Arena-log, or UI behavior.
- macOS signing/notarization, PyPI publishing, Homebrew publishing, and website changes.
- Paid Microsoft Store products while the documented GitHub Actions update path supports free products only.
- Provisioning or requiring a maintainer-owned, paid, or persistent Windows desktop; final Store-acquisition verification remains a manual external check when a Windows 11 device is available.

## Child issues

- [ ] [Reserve the Microsoft Store product and package identity](https://github.com/andreagrandi/draftomen/issues/326)
- [ ] [Build and validate the MSIX package in GitHub Actions](https://github.com/andreagrandi/draftomen/issues/327)
- [ ] [Publish the first Microsoft Store release](https://github.com/andreagrandi/draftomen/issues/328)
- [ ] [Automate Microsoft Store updates from tagged releases](https://github.com/andreagrandi/draftomen/issues/329)
- [ ] [Cut over Windows releases to the Microsoft Store](https://github.com/andreagrandi/draftomen/issues/330)

## Acceptance Criteria

- [ ] Every child issue is complete and linked to this epic as a native GitHub sub-issue.
- [ ] The public Store product is configured as a free Windows Desktop app and its assigned identity is used verbatim by the MSIX manifest.
- [ ] GitHub-hosted Windows CI produces the Store submission artifact and proves package installation, launch through the existing deterministic workflow, and removal without a maintainer-owned Windows machine.
- [ ] The first submission passes Microsoft certification, is signed by Microsoft, and reaches **In the Store** status.
- [ ] A protected tagged-release workflow submits later versions to the live Store product without exposing Partner Center credentials to pull requests or development builds.
- [ ] A manual check on an externally available Windows 11 device acquires the published app, launches the representative workflow, receives a Store update, and uninstalls it; this is the only verification step that cannot run on GitHub-hosted server runners.
- [ ] Windows users are directed to the Microsoft Store, no unsigned Windows executable is published as a public release asset, and macOS, PyPI, and Homebrew distribution remain unchanged.

## Epic classification

- **Overall size:** XL
- **Overall orchestration risk:** High
- **Reason:** The work has five independently reviewable outcomes across Partner Center onboarding, MSIX packaging, hosted Windows validation, external certification, credentialed release automation, and distribution cutover.

## References

- [Reserve an MSIX app name](https://learn.microsoft.com/en-us/windows/apps/publish/publish-your-app/msix/reserve-your-apps-name)
- [View Store app identity details](https://learn.microsoft.com/en-us/windows/apps/publish/view-app-identity-details)
- [Generate MSIX package components for a desktop app](https://learn.microsoft.com/en-us/windows/msix/desktop/desktop-to-uwp-manual-conversion)
- [Create an MSIX app submission](https://learn.microsoft.com/en-us/windows/apps/publish/publish-your-app/msix/create-app-submission)
- [Microsoft Store certification and signing](https://learn.microsoft.com/en-us/windows/apps/publish/publish-your-app/msix/app-certification-process)
- [Microsoft Store Developer CLI](https://learn.microsoft.com/en-us/windows/apps/publish/msstore-dev-cli/overview)
- [Publish Store updates with GitHub Actions](https://learn.microsoft.com/en-us/windows/apps/publish/msstore-dev-cli/github-actions)