Publish Windows CLI packages alongside NuGet on main

[cangelosilima]

Adds Chocolatey and WinGet distribution for the Windows x64 syncsql CLI. The CLI NuGet workflow calls Windows packaging alongside its publish job, sharing the version, release tag and tested commit. Only protected-main push events publish.

• Builds a self-contained executable and generates SHA-256-pinned package metadata.
• Shares the CLI GitHub release with recovery for concurrent publishers and reruns.
• After NuGet publication, installs the exact version directly from nuget.org on fresh Linux, Windows and macOS runners.
• After Windows registry submissions, installs the exact version directly from the Chocolatey community feed and WinGet catalog on two fresh Windows runners. No local-feed, local-manifest or release-asset fallback is used.
• All installation checks verify the version, help output, PATH command and uninstall/removal.
• Public sources retry for propagation/approval delays. If moderation takes longer, the verification job fails and can be rerun, or the public-source workflow can be run manually after approval. Submission jobs remain successful.
• Documents credentials, moderation and the outstanding application-license decision.

Validation: 14 packaging/release tests passed; actionlint passed for all three changed workflows; the clean Windows build and CLI smoke test passed. The shared installation assertion accepted the built binary and rejected an incorrect version. Public-source installation jobs require publication and have not run locally.

Earlier validation: solution build and CLI tests/coverage passed (100% coverage). Site formatting, lint, type checks and coverage passed; one existing packaging test exceeded its 5-second timeout. The pre-push hook did not reach mutation checks; pushes used the documented hook exception. No site code changes are included.

Local Node 25 tests need NODE_OPTIONS=--no-experimental-webstorage. The hook's checkout-filter test needs an explicit GIT_WORK_TREE when tests run from site/.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-04T05:04:29.182055Z	d6d9d1c	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Quality results

Quality gate: success
Commit: 321193b0c838df48a2b147b4379b381a76e651ab · View run and reports

Check	Result
Dependency vulnerabilities	success
CodeQL	success
CLI lint and format	success
CLI tests and coverage	success
CLI mutation (Core ≥90%, selected command files ≥55%)	success
CLI performance budgets	success
Site lint and format	success
Site tests and coverage	success
Site reachability mutation (100%)	success
Workflow lint	success
Coverage badge data	success

Line coverage	Measured	Minimum
CLI	100%	100%
Site	100%	80%

CLI line, branch, method, and full method coverage must each reach 100%. A missing report is shown as unavailable. See the linked run for test failures, detailed CLI/Site coverage summaries and HTML reports, and scanner results.