Build and validate the MSIX package in GitHub Actions

## Problem

The hosted Windows build currently produces one unsigned Nuitka executable. The repository has no MSIX manifest, Store asset set, package layout, Store identity integration, four-part version mapping, installed-package test, or Store submission artifact.

## Proposed change

Add an explicit MSIX package definition for the existing frozen PySide desktop application. Stage the Nuitka executable and required resources, generate the `.msix` with Windows SDK tooling on `windows-latest`, then assemble and validate the recommended `.msixupload` archive separately. Use a disposable test certificate only for CI installation; production distribution relies on Microsoft Store signing. Validate the package structure and exercise install, deterministic launch, and removal on hosted Windows infrastructure.

## Acceptance Criteria

- [ ] AC1: The manifest uses the Partner Center identity verbatim, targets x64 `Windows.Desktop`, launches the existing executable as a packaged classic desktop app, and declares only the required full-trust capability.
- [ ] AC2: The package contains the executable, runtime resources, and every required MSIX visual asset, and its display metadata matches Draft Omen.
- [ ] AC3: The project version maps deterministically to a valid, monotonically increasing four-part MSIX version and duplicate or regressing versions fail before packaging.
- [ ] AC4: A GitHub-hosted Windows job builds the frozen app, uses pinned or runner-provided Windows SDK tooling to produce a `.msix`, and separately creates a `.msixupload` archive containing that package and any generated symbol payload.
- [ ] AC5: Focused tests and package validation fail on an invalid identity, executable path, architecture, capability, asset set, or version.
- [ ] AC6: CI test-signs a disposable copy, installs it for the runner user, launches the existing deterministic mock smoke workflow from the installed package, and removes it successfully.
- [ ] AC7: No production certificate, PFX, or signing secret is required or retained; the validated `.msixupload` and checksum of its contained `.msix` are uploaded as CI artifacts for the publication ticket.

## Dependencies

Blocked by **Reserve the Microsoft Store product and package identity**.

## Implementation classification

- **Estimated size:** M
- **Orchestration risk:** High
- **Reason:** The change adds a new full-trust package lifecycle across manifest, assets, versioning, Windows SDK tooling, CI installation, and smoke verification.