feat: build and release for windows and linux

[jamubc]

Why

Lineage is a macOS menu-bar app in every layer: open shell-outs carry OAuth and every external link, the uninstall flow is bash plus ~/Library, the headline number renders as tray title text (a macOS-only concept), and the bundle targets and release workflow stop at Apple Silicon. The engine underneath (git churn, GitHub API, SQLite, keyring) is already cross-platform, so Windows and Linux support is about the shell, packaging, and CI.

What Changes

• Replace every open shell-out with tauri-plugin-opener (open_url, open_path, reveal_item_in_dir), which un-breaks OAuth sign-in, GitHub links, the data-folder action, and the image reveal off macOS.
• Render the live number into the tray icon on Windows and Linux with a 3x5 pixel font at the largest scale that fits (sign carried by color, added over removed for the two-figure metric), with the exact value in the tooltip; macOS keeps the status-item title. The sync spinner gains a neutral gray fill so it is visible outside the macOS template-tinted menu bar.
• Gate the in-app uninstall (command, tray menu entry, and settings section) to macOS; Windows gets the NSIS uninstaller and a Linux AppImage is deleted as a file.
• Route all git and gh subprocesses through one constructor that sets CREATE_NO_WINDOW on Windows, so the parallel sync cannot flash console windows; a missing git binary now produces a friendly install hint. The Homebrew gh lookup paths are gated to macOS.
• Add nsis and appimage bundle targets, convert release.yml to a three-OS matrix with per-platform install notes, and add build.yml running check, tests, and tauri build --no-bundle on all three platforms for every PR.
• Make Keychain/menu-bar wording platform-aware in onboarding, settings, and the close prompt; pin the Rust toolchain and Node engine; document per-platform install in the README.

ADDED Requirements

Requirement: Cross-Platform Release Artifacts

A v* tag SHALL produce a draft GitHub release containing macOS (.dmg, .app.tar.gz), Windows (NSIS -setup.exe), and Linux (.AppImage) artifacts plus one latest.json listing all three platforms, signed with the existing minisign key. CI MUST NOT publish the draft; publishing after a smoke test is the ship gate.

Requirement: Platform-Appropriate Tray and Shell

On Windows and Linux the tray SHALL show the configured metric drawn into the icon with the exact value as tooltip, external links MUST open in the default browser, and no subprocess may flash a console window. macOS behavior MUST remain unchanged: title text next to the glyph icon, template-tinted spinner, and the in-app uninstall flow.

Scenario: Release matrix ships all platforms

• GIVEN a pushed v* tag
• WHEN the release workflow finishes
• THEN the draft release holds the dmg, NSIS setup, AppImage, signed updater archives, and a latest.json with darwin-aarch64, windows-x86_64, and linux-x86_64 entries

Scenario: Windows user signs in and syncs

• GIVEN a connected Windows install with Git for Windows on PATH
• WHEN the user signs in via the device flow and a sync runs
• THEN the verification URL opens in the default browser, no console windows flash during the clone loop, and the tray icon shows the net number with the exact value on hover

Verification

1. Build
   1.1 cargo test --workspace --manifest-path src-tauri/Cargo.toml passes.
   1.2 npm run check reports 0 errors and 0 warnings; npm test passes.
   1.3 npm run tauri -- build --no-bundle compiles the release binary on macOS.
2. CI
   2.1 The new build.yml goes green on macos-latest, ubuntu-22.04, and windows-latest for this PR.
3. Behavior
   3.1 macOS keeps the tray title, template spinner, uninstall entry, and working links.
   3.2 The Windows and Linux legs (tray number icon, opener, no console flash) are exercised by the next draft release and its smoke test before publishing.