WinGetSourceCreator: add opt-in progress/audit logging to the offline source build pipeline

Feature request

This is a feature request: add opt-in progress/audit logging to the offline source build pipeline.

Prerequisite: #6426 / #4181 must be fixed first

This fix depends on
#6426 (re-file of
#4181). Today
CopyManifestFile fails to create destination subdirectories, so the
IndexCreationTool / WinGetSourceCreator path breaks before it ever reaches
index creation - the tool cannot be used at all for anything laid out in
subfolders (which includes every real multi-file manifest).

Both fixes are required for the end-to-end offline-source scenario:

1. #6426 / #4181 - create destination subdirectories in CopyManifestFile
   (prerequisite; without it the tool is unusable for subfoldered input).

Summary

WinGetSourceCreator / IndexCreationTool currently runs almost silently. When it fails, it typically surfaces a single terminal exception (e.g. DirectoryNotFoundException) with no record of what it was doing — which config was read, which working directory was cleaned, which manifests were added to the index, which package was signed and with what command line. This makes both debugging and — more importantly — audit effectively impossible.

Please add opt-in progress/diagnostic logging to the source-creation pipeline so that building an offline source produces a reviewable, reproducible record of exactly what went into it.

Why this matters (air-gapped / regulated environments)

The pre-indexed offline source (source.msix + index.db) is consumed in air-gapped, heavily regulated environments (finance, gaming/gambling, defense, healthcare). In those environments the build of the offline package is a controlled, auditable step: reviewers/compliance need evidence of which manifests were included, that the index was built cleanly, and that the package was signed with the expected certificate and timestamp. Today none of that is captured. A silent tool that emits only a stack trace on failure does not meet audit requirements.

This is the counterpart audit-trail improvement regulated users need on top of the existing correctness fixes.

Proposed change

Emit progress messages at the key stages of the pipeline. In our internal build we added these Console.WriteLine calls (illustrative — a proper implementation should route through a real logger / verbosity switch rather than raw Console.WriteLine):

• Reading the config file
• Cleaning the working directory (Cleaning working directory: <path>)
• Index creation lifecycle:
  • Creating index.db / Creating <fullPath>
  • Deleting existing index.db: <fullPath>
  • Found <N> manifest files to add to index.
  • Adding manifest to index: <file> (per manifest)
  • Finished creating index.db
  • full exception detail on failure (Exception: <ex>)
• Package creation:
  • Creating AppxPackage <packageName>...
  • Creating mapping file... + the mapping file contents
  • Copying manifest file: <src> to <destDir> (per file)
• Signing / packing:
  • the exact makeappx.exe command line being executed
  • the exact signtool.exe command line being executed (with cert path and timestamp server)

Requested design (not just raw Console.WriteLine)

Rather than unconditional console spam, please expose this as:

• a verbosity / --verbose switch (or an ILogger-style sink) so normal runs stay quiet and audited runs can capture full detail, and
• ideally the ability to write the log to a file alongside the produced source.msix, so the audit record can be archived with the artifact.

Environment

• Windows 10 / 11
• winget-cli master
• Component: src/WinGetSourceCreator (used by IndexCreationTool)

I'm happy to submit a PR implementing this if a maintainer confirms it will be reviewed.

Resolve prerequisite #6426/#4181 first, then trace the offline-source pipeline under src/WinGetSourceCreator and its use by IndexCreationTool. Identify the config, index creation, package-copying, and signing stages named in the issue, and check how command-line options are handled. Done means opt-in logging captures those stages and command lines, with an optional archived log, while normal runs remain quiet.