feat: add Chocolatey and WinGet integration

[desimone]

Summary

Windows users have to download Pomerium Desktop from GitHub by hand and watch this repository for new releases, so they cannot fold the client into the Chocolatey or WinGet automation they already run for the rest of their fleet.

This adds a generator that turns one exact stable release tag into both catalog formats. It reads the GitHub release once, refuses anything that is not a published stable tag with exactly one fully uploaded installer asset carrying a SHA-256 digest at the canonical download URL, and writes the verified descriptor beside the generated files. Both renderers are pure functions of that descriptor, so the Chocolatey package and the WinGet manifests can never disagree about a version, URL, or checksum. The generated files for v0.33.0 are checked in as golden fixtures, which makes the catalog text itself reviewable in a diff.

A validation workflow proves the result on windows-2025. The Chocolatey job runs the whole lifecycle: it rejects a corrupted checksum and leaves no trace, installs v0.32.2 silently, upgrades to v0.33.0, and uninstalls, asserting at each step that exactly one current-user Apps and Features entry exists with the expected name, version, publisher and quiet uninstall string, that the install directory and executable match the release, that both shortcuts exist, and that uninstall removes all of it. That job runs 43 assertions.

The WinGet manifests declare ElevationRequirement: elevationProhibited. Running this per-user NSIS installer elevated crashes it, and WinGet elevates installers by default, so without that field winget install from an administrator console dies with an access violation inside NSIS rather than reporting anything useful. GitHub-hosted runners are themselves elevated, so the WinGet job proves what an elevated session can: all three manifests validate, and WinGet refuses the install with "the installer cannot be run from an administrator context" and leaves no residue. The harness runs the same full install, upgrade and uninstall lifecycle as Chocolatey when it is given a non-elevated session, and it records the skip and its reason in the evidence rather than passing silently. Closing that gap needs a non-elevated Windows runner and is worth deciding separately.

The manifests target ManifestVersion 1.10.0. winget validate checks the schema header against the $id of the schema file that the installed client carries, so a manifest declaring a newer version than the shipping client warns and exits non-zero.

The license field in package.json said MIT while LICENSE has always been Apache 2.0. The generated WinGet locale manifest has to declare a license, so this corrects the field rather than publishing a claim that contradicts the repository.

This PR wraps the existing unsigned x64 per-user NSIS installer. It publishes nothing, adds no catalog credentials, and does not change the installer or the release process. The first submission to each catalog is a separate, separately approved step.

npm run format:check, npm run lint and npm test pass locally; generating v0.33.0 against the live GitHub API reproduces the checked-in golden files byte for byte; and all three manifests validate against the official 1.10.0 JSON schemas. Both Windows jobs pass, and each uploads its logs, registry snapshots and machine-readable assertion summary.

This change was implemented with AI assistance.

Related issues

• ENG-4284: Feature Request: Chocolatey / Winget Installation

Checklist

• reference any related issues
• updated docs
• updated unit tests
• updated UPGRADING.md (not required; installer and upgrade behavior do not change)
• add appropriate tag (improvement)
• ready for review