…ase checklist (koala73#49)

### Motivation
- Provide reproducible local packaging commands for both product
variants (full vs tech) across macOS and Windows.
- Make signing/notarization and Authenticode flows optional and
environment-driven so builds can be reproducible unsigned or signed when
keys are available.
- Ensure release artifacts and variant identities are documented and
easy to validate on a clean machine.

### Description
- Added deterministic packaging scripts to `package.json` for macOS
(`.app` + `.dmg`) and Windows (`NSIS .exe` + `.msi`) for both `full` and
`tech` variants and optional signed variants via environment variables.
- Updated `src-tauri/tauri.conf.json` and
`src-tauri/tauri.tech.conf.json` to explicitly target `app`, `dmg`,
`nsis`, and `msi`, and added a Windows signing/timestamp hint (`sha256`
+ timestamp URL).
- Added `docs/RELEASE_PACKAGING.md` containing per-OS packaging
commands, optional signing/notarization env hooks, artifact output
locations, and a clean-machine startup validation checklist.
- Linked the new packaging guide from `README.md` and surfaced the new
`npm run desktop:package:*` commands in the contributor command block.

### Testing
- Verified the updated JSON files parse successfully with a `node -e`
JSON parse check (succeeded).
- Ran `npm run -s typecheck` (TypeScript `tsc --noEmit`) to ensure no
type regressions (succeeded).

------
[Codex
Task](https://chatgpt.com/codex/tasks/task_e_698ebfa41cbc8333ba9aeeab79aa8a72)

- koala73#34: Remove isProUser() guard from setupAuthWidget(). New users now
  see the sign-in button and can create accounts. The guard was
  intentionally deferred; removing it is the stated end-state.

Close stale todos whose fixes already landed in prior PRs:
- koala73#10: inferEntityClassFromName word-boundary regex (already in code)
- koala73#11: entity key collision fix using candidateStateId (already in code)
- koala73#12: priorWorldState threading to writeSimulationPackage (already in code)
- koala73#13: sanitizeForPrompt on simulation builder strings (already in code)
- koala73#14: allForecastIdSet Set-based lookup (already in code)
- koala73#35: algorithms:['RS256'] in jwtVerify (already in auth-session.ts)
- koala73#41: frameworkHash in deduct-situation cache key (already in code)
- koala73#42: isCallerPremium server-side premium gate (already in code)
- koala73#43: SSRF — ALLOWED_AGENTSKILLS_HOSTS + redirect:manual (already fixed)
- koala73#44: sanitizeForPrompt on systemAppend before LLM (already in code)
- koala73#45: systemAppend included in getCacheKey (already in code)
- koala73#49: shippingStress/diseaseOutbreaks/socialVelocity in BOOTSTRAP_KEYS

https://claude.ai/code/session_015fz1MvRuBJGYbgHubGEabA