Per decision: no binaries committed to the repo; everything is built on GitHub
Actions and hosted as release artifacts (releases/latest/download/<artifact>).
- .github/workflows/release.yml: matrix builds the agent for
linux(amd64/arm64/armv7), windows(amd64/arm64), darwin(amd64/arm64); tray for
linux/windows; helper for windows; the fully-offline Inno setup.exe compiles on
a windows runner via scripts/setup-build-env.ps1 -SkipGo -Build -CI. The
publish job merges everything, writes SHA256SUMS, optionally signs with Azure
Trusted Signing (secret-gated), and attaches to the tag's release.
- Replaces build-windows.yml (removed) — one release pipeline for all platforms.
- Untracks the committed dist binaries (they stay gitignored for local dev and
are produced by CI now).
- DESIGN-WINDOWS.md §9 updated: consumers (install.sh, the SSO modal) download
from GitHub release artifacts; SSO may mirror them into /resources for air-gap.
