feat(packaging): scaffold Flathub, Snap Store, and Microsoft Store publishing

[hamidfzm]

Summary

Scaffolds publishing to three new distribution stores, tracked by the issues created alongside this work:

• Flathub (Flatpak) — Publish Glyph to Flathub (Flatpak) #290
• Snap Store — Publish Glyph to the Snap Store #291
• Microsoft Store — Publish Glyph to the Microsoft Store #292

These complement the existing Homebrew / Chocolatey / Scoop / AUR / PPA / apt channels. This PR adds the in-repo packaging metadata and the automation that can be turned on without breaking existing releases. The store accounts, secrets, and initial store submissions remain manual maintainer steps (documented in each issue).

Changes

• Flatpak/Flathub
  • flatpak/com.hamidfzm.glyph.metainfo.xml — AppStream metadata (summary, description, screenshots, categories, OARS rating, release entry).
  • flatpak/com.hamidfzm.glyph.desktop — desktop entry with the markdown MIME association.
  • flatpak/com.hamidfzm.glyph.yml — manifest that installs the released .deb into the GNOME 50 runtime (per-arch sources with pinned v0.10.0 sha256s).
  • publish-flathub job in release.yml that rewrites the version + per-arch sha256 each release and pushes the manifest, desktop, and metainfo to the Flathub app repo (flathub/com.hamidfzm.glyph), whose buildbot then publishes. Gated on a FLATHUB_TOKEN secret, so it is a no-op until the Flathub submission is accepted.
• Snap
  • snap/snapcraft.yaml — core22, strict confinement, built from the released .deb. The recipe auto-discovers the latest release and pulls the .deb for the build arch (snapcraft does not forward host env into the build instance, so a GLYPH_VERSION input couldn't reach it; publish-snap runs after publish, so "latest" is the triggering tag).
  • publish-snap job in release.yml (amd64 + arm64). Gated on a SNAPCRAFT_STORE_CREDENTIALS secret, so it is a no-op (green, skipped steps) until the Snap Store account is set up and never fails a release before then.
• Microsoft Store
  • msstore/README.md — documents the installer-submission approach and the one-time Partner Center setup. The CI job is intentionally deferred until the packaging path (installer vs MSIX) and product ID are decided, since the submission inputs depend on them.
• CI
  • validate-packaging job validates the AppStream metainfo (appstreamcli validate), the desktop entry (desktop-file-validate), and that the Flatpak/Snap YAML manifests parse.
• Docs
  • README and the release-notes Linux blocks (both occurrences in release.yml) now list the Flathub (flatpak install flathub com.hamidfzm.glyph) and Snap (sudo snap install glyph) install commands.
  • Removed the README "Keyboard Shortcuts" table; shortcuts live in the native menus and are remappable in Settings, Hotkeys. Also dropped the now-stale reference to that table in .claude/rules/docs.md.

Pre-merge checklist

• Register the Snap name (snapcraft register glyph; fall back to glyph-md if taken) and add the SNAPCRAFT_STORE_CREDENTIALS repo secret (snapcraft export-login).
• Run a full snapcraft --build-for amd64 (and arm64) on a host with LXD, then snap install --dangerous and smoke-test. The pull/extract logic and .deb paths were validated in WSL (see below), but the full pack needs LXD (couldn't run here: LXD install is sudo-gated and snapd-in-Docker doesn't support the GNOME extension). CI builds arm64 natively on ubuntu-22.04-arm.
• Validate the Flatpak build in a Linux env: flatpak-builder --user --install --force-clean build-dir flatpak/com.hamidfzm.glyph.yml; confirm it launches and opens a .md file.
• Fill the real per-arch sha256 sums + version in flatpak/com.hamidfzm.glyph.yml (done for v0.10.0) and bump the GNOME runtime-version to a current one (50). The runtime choice still needs a real flatpak-builder run to confirm webkit2gtk-4.1 resolves at runtime.
• Confirm the .deb lays files at the paths the Flatpak/snap expect. Validated against the real v0.10.0 .deb in WSL; this caught two bugs now fixed: the desktop file is Glyph.desktop (capital G), and icons ship at 32x32, 128x128, 256x256@2 (not 256x256, no 128x128@2x).
• Submit the manifest to flathub/flathub (one-time). Update strategy is decided: the canonical manifest stays in this repo and the publish-flathub job pushes each release to flathub/com.hamidfzm.glyph; set the FLATHUB_TOKEN secret once that repo exists.
• Decide whether the Flathub/Snap install instructions ship now (forward-looking until the listings are live) or are gated until then.
• (Microsoft Store, can be a follow-up) create the Partner Center account, decide installer vs MSIX, then add the deferred publish-msstore job + PARTNER_CENTER_* secrets.
• CI green, including the new validate-packaging job on a Linux runner.

Testing

• validate-packaging runs the AppStream/desktop/YAML validators in CI.

• Locally verified the XML and all YAML files parse, and the full pre-commit gate (typecheck, frontend tests, Rust tests, clippy) passes.

• The Flatpak manifest sha256s and runtime version, and the snap build, need a hands-on run in a Linux/flatpak/snapcraft environment before the first store submission (called out in Publish Glyph to Flathub (Flatpak) #290 / Publish Glyph to the Snap Store #291).

• Tested on macOS

• Tested on Windows

• Tested on Linux

Screenshots

N/A (packaging, CI, and docs only).

Refs #117, #290, #291, #292