[Marc-André Moreau (mamoreau-devolutions)]

Summary

• Add reusable Rust and .NET publishing libraries and matching pinget repository build|diff|status|verify|publish|doctor commands, independent of ordinary client/source initialization.
• Generate native WinGet v2 SQLite indexes, merged manifests and MSZIP version-data sidecars from standard Windows manifests. Publish immutable metadata first and replace source2.msix last.
• Provide Windows SDK MSIX packaging/PFX signing, explicit unsigned development mode, identity/version checks, destination locks, ownership inventories and rollback/retry protection.
• Include review hardening for locale merging, schema string preservation, byte-level parity, correlation data, state/path verification, tool discovery and 64 MiB bounds. Artifact-format-v2 state rejects legacy artifacts without mutation.
• Integrate packaging/release/version synchronization and static-hosting documentation. All publisher fixture, validation and comparison scripts are now PowerShell, not Python; no Python/PyYAML setup or dependency remains.
• Preserve independent native SQLite/MSZIP inspection and exact manifest/sidecar comparison through PowerShell helpers using existing .NET build dependencies, rather than relying only on production verification.
• Maintain meaningful non-Windows validation while gating native Windows generation tests. Both macOS packaging matrices use supported macos-15 runners with unchanged architecture targets.

Validation — all checks green

• All 14 PR checks passed on final head 363e187: CI and CLI NuGet Packages. Includes Rust lint/build/tests, .NET/PowerShell tests, all six Rust CLI targets, both Windows NativeAOT targets, pack/smoke and signed stock-client acceptance.
• Hardened signed outputs from both publishers passed stock WinGet on a disposable Windows runner: source add/update, search/show, multi-block version data, SHA-256-verified harmless download, version bumps, additions/removals and cached metadata retention. Both Pinget readers consume each feed. Latest signed gate. The documented tested hosted-client baseline is WinGet 1.11.510 / App Installer 1.26.510.0.
• Runner-local, short-lived signing/TLS credentials and temporary source registrations are cleaned up and verified. No Sandbox, repository secrets or developer-host trust/source mutations.
• Rust initial_publish_post_copy_failure_cleans_destination_and_allows_retry proves actual copied hashes before injected failure, complete cleanup, unchanged publication state, preserved snapshot and a successful normal retry. The public API and verification ordering remain unchanged.
• .NET Publish_InitialPostCopyMsixVerificationFailure_CleansArtifactsAndAllowsRetry uses real MakeAppx behind a test-only identity-mutating wrapper to prove post-copy failure cleanup and successful retry.
• PowerShell replacements passed local fixture schema/MSZIP/MSIX checks, independent validation of both snapshots, exact cross-language comparison, output-format checks and a negative corrupted-index-digest check. Managed production driver exits 0; NativeAOT snapshots validate and compare successfully. CI reran the new PowerShell production driver successfully.
• Rust publisher suites: 40 Windows tests and 24 Ubuntu WSL tests; Ubuntu CI is green. .NET Core baseline: 274 passed plus 1 existing live-source skip; publisher baseline 57 plus focused follow-up. Formatting, Clippy, rustdoc, AOT and script/workflow syntax pass.

Scope limits

• Windows WinGet-compatible v2 publishing only. No REST server, cloud uploader, DSC/MCP integration, macOS execution, policy agent or new PowerShell cmdlets.
• Compatibility covers tested clients/fixtures/toolchains, not every client or manifest field; supported manifest versions 1.0.0–1.10.0 receive structural/required-field checks, not exhaustive upstream JSON-schema validation.
• The pre-existing SQLitePCLRaw.lib.e_sqlite3 2.1.11 NU1903 advisory is unchanged.
• Release the matching updated Rust core before the publisher, as documented.