v1.99.0: semver correction for the 5 feature modules + winget/chocolatey trigger fix (#20)

* v1.99.0 — correct semver for the 5 feature modules + fix winget/chocolatey triggers

SEMVER CORRECTION:
The five feature modules (Azure Arc, Defender for Endpoint, WSUS, AD CS,
Storage Migration) were each shipped as a patch bump (v1.98.58-1.98.62).
That was wrong — a new feature is a minor bump (the y in x.y.z), not a
patch. They are now consolidated into a single proper minor release,
v1.99.0, consistent with how v1.93.0 / v1.95.0 / v1.96.0 / v1.97.0 were
each feature releases on the minor track.

- Version bumped 1.98.62 -> 1.99.0 across Header.ps1, RackStack.ps1,
  RackStack.psd1, Modules/00-Initialization.ps1, Tests/Run-Tests.ps1.
- Changelog.md: the five v1.98.58-1.98.62 entries are replaced by one
  consolidated v1.99.0 entry. v1.98.55-57 (audit fixes, coverage,
  Silver-badge infra — genuinely patches) are unchanged.
- The mis-numbered v1.98.62 GitHub release + tag are deleted separately
  (see release cleanup). v1.98.58-62 on PowerShell Gallery are immutable
  and cannot be deleted — they can only be unlisted via the PSGallery UI.

WINGET / CHOCOLATEY TRIGGER FIX:
The standalone winget.yml and chocolatey.yml workflows triggered on
 — but a release created with GITHUB_TOKEN (which is
how ci.yml creates releases) does NOT trigger  event workflows
(GitHub recursion-prevention). So they never ran once.

- winget + chocolatey submission are now inlined as steps in the ci.yml
  release job, right after the GitHub Release + PowerShell Gallery
  publish steps. They run exactly when a release is cut.
- A 'Detect publish tokens' step exposes WINGET_TOKEN / CHOCO_API_KEY
  presence as step outputs (the secrets context is not usable in step
  if: conditions); the winget/choco steps gate on those.
- Both are continue-on-error so a publish hiccup never fails a release.
- Standalone .github/workflows/winget.yml + chocolatey.yml deleted.
- dist/README.md + dist/chocolatey/README.md updated to describe the
  inlined approach.

PSSA 0/0, regex harness 4759/4759, Pester 312/312. RackStack v1.99.0:
70 modules, 181 CLI actions.

* fix(ci): use wingetcreate CLI instead of winget-releaser action

The winget-releaser action pulls in an unpinned transitive action
(cargo-bins/cargo-binstall@main); the repo's sha_pinning_required policy
correctly rejected the whole workflow run.

Switch the winget submission step to download + run Microsoft's
wingetcreate.exe directly — a single signed binary with no nested
actions, so it stays inside the SHA-pinning policy. wingetcreate update
handles every release after the package exists in winget-pkgs; the
first-ever submission is a documented one-time manual step.

Author: TheAbider

.github/workflows/chocolatey.yml

@@ -494,6 +494,100 @@ jobs:
           }
           exit 0
 
+      # Detect which publish-channel tokens are configured. The `secrets`
+      # context is not reliably usable in step-level `if:` conditions, so
+      # presence is checked here and exposed as step outputs the winget /
+      # chocolatey steps gate on.
+      - name: Detect publish tokens
+        id: pubtokens
+        if: steps.vercheck.outputs.bumped == 'true' && steps.releasecheck.outputs.exists == 'false'
+        env:
+          WT: ${{ secrets.WINGET_TOKEN }}
+          CT: ${{ secrets.CHOCO_API_KEY }}
+        run: |
+          $w = if ([string]::IsNullOrWhiteSpace($env:WT)) { 'false' } else { 'true' }
+          $c = if ([string]::IsNullOrWhiteSpace($env:CT)) { 'false' } else { 'true' }
+          "winget=$w" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
+          "choco=$c"  | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
+          Write-Host "winget token: $w   choco token: $c"
+
+      # Submit to winget-pkgs. Inlined into the release job (rather than a
+      # separate workflow on `release: published`) because a release created
+      # with GITHUB_TOKEN does NOT trigger `release` event workflows — GitHub's
+      # recursion-prevention. Running it here fires exactly when a release is
+      # cut. continue-on-error so a winget hiccup never fails the release.
+      #
+      # Uses Microsoft's wingetcreate CLI directly rather than a winget
+      # submission Action — the popular winget-releaser Action pulls in an
+      # unpinned transitive action (cargo-bins/cargo-binstall@main), which the
+      # repo's SHA-pinning policy correctly rejects. wingetcreate is a single
+      # signed .exe with no nested actions, so it stays inside the policy.
+      #
+      # `wingetcreate update` requires the package to already exist in
+      # winget-pkgs. The FIRST submission of TheAbider.RackStack is a one-time
+      # manual step (`wingetcreate new` locally, or a hand-authored manifest
+      # PR — see dist/README.md). Every release after that is automated here.
+      - name: Submit to winget-pkgs
+        if: steps.pubtokens.outputs.winget == 'true'
+        continue-on-error: true
+        env:
+          WINGET_TOKEN: ${{ secrets.WINGET_TOKEN }}
+        run: |
+          $ver = '${{ steps.vercheck.outputs.version }}'
+          $exeUrl = "https://github.com/$env:GITHUB_REPOSITORY/releases/download/v$ver/RackStack.exe"
+          $wc = Join-Path $env:RUNNER_TEMP 'wingetcreate.exe'
+          Write-Host "Downloading wingetcreate..."
+          Invoke-WebRequest -Uri 'https://aka.ms/wingetcreate/latest' -OutFile $wc -UseBasicParsing
+          Write-Host "Submitting TheAbider.RackStack v$ver to winget-pkgs..."
+          & $wc update TheAbider.RackStack --version $ver --urls $exeUrl --submit --token $env:WINGET_TOKEN
+          if ($LASTEXITCODE -ne 0) {
+            Write-Host "wingetcreate exit $LASTEXITCODE — if this is the first-ever submission,"
+            Write-Host "the package does not exist in winget-pkgs yet; do the first one manually"
+            Write-Host "(see dist/README.md). Subsequent releases will auto-submit."
+          }
+          $global:LASTEXITCODE = 0
+          exit 0
+
+      # Publish to the Chocolatey Community Repository. Inlined for the same
+      # reason as winget above. The EXE is already built in builds\ for this
+      # run, so no download is needed.
+      - name: Publish to Chocolatey
+        if: steps.pubtokens.outputs.choco == 'true'
+        continue-on-error: true
+        env:
+          CHOCO_API_KEY: ${{ secrets.CHOCO_API_KEY }}
+        run: |
+          $ver = '${{ steps.vercheck.outputs.version }}'
+          $exe = 'builds\RackStack.exe'
+          if (-not (Test-Path -LiteralPath $exe)) {
+            Write-Host 'RackStack.exe not present — skipping Chocolatey publish.'
+            exit 0
+          }
+          $hash = (Get-FileHash -LiteralPath $exe -Algorithm SHA256).Hash.ToLower()
+          Push-Location dist/chocolatey
+          # Stamp the templated nuspec + install script with this version + hash.
+          (Get-Content 'rackstack.nuspec' -Raw) -replace '<version>0\.0\.0</version>', "<version>$ver</version>" |
+            Set-Content 'rackstack.nuspec' -Encoding utf8
+          (Get-Content 'tools/chocolateyinstall.ps1' -Raw) `
+            -replace '__VERSION__', $ver `
+            -replace '__CHECKSUM_SHA256__', $hash |
+            Set-Content 'tools/chocolateyinstall.ps1' -Encoding utf8
+          choco pack rackstack.nuspec
+          $nupkg = Get-ChildItem -Filter 'rackstack.*.nupkg' | Select-Object -First 1
+          if ($nupkg) {
+            Write-Host "Pushing $($nupkg.Name) to Chocolatey..."
+            choco apikey --key $env:CHOCO_API_KEY --source https://push.chocolatey.org/
+            choco push $nupkg.FullName --source https://push.chocolatey.org/
+            if ($LASTEXITCODE -ne 0) {
+              Write-Host "choco push exit $LASTEXITCODE — first submissions queue for moderation."
+            }
+          } else {
+            Write-Host "choco pack produced no .nupkg."
+          }
+          $global:LASTEXITCODE = 0
+          Pop-Location
+          exit 0
+
       - name: Apply retention rule (only latest z in minor survives)
         if: steps.vercheck.outputs.bumped == 'true' && steps.releasecheck.outputs.exists == 'false'
         env: