ci(packaging): install-test the Chocolatey package on a throwaway runner

[jpicklyk]

Summary

There's no local sandbox for the pre-push install test of the Chocolatey package, so this uses a fresh windows-latest runner as the sandbox: a throwaway VM with choco preinstalled and admin rights. This PR's own CI run is that test, against v0.13.3.

• scripts/verify-chocolatey.ps1 runs five checks. Every check runs even after an earlier one fails; the script prints the full list of failures at the end:
  1. Install: exit 0; the app is at C:\Program Files\LogTapper\log-tapper.exe with logtapper-mcp.exe beside it; Add/Remove Programs shows LogTapper with publisher Jeff Picklyk and the right version; .lts and .ltw are registered.
  2. Reinstall over a running app with --force: exit 0, and the installer closes the app instead of stopping on it. If a headless runner won't keep the GUI running, the log says so as a warning rather than silently passing.
  3. Uninstall: exit 0; the app and its Add/Remove Programs entry are gone within 60 s; no leftover sidecar process. It also records whether files were still present when choco returned, which settles whether the NSIS uninstaller runs detached (the plan's open _?= question).
  4. Uninstall after the app was already removed by hand: choco uninstall exits 0 through the script's "nothing to uninstall" path.
  5. Tampered checksum: an install from a package with one checksum digit changed fails and installs nothing.
• "Settings shows the normal update controls" needs no UI check. The unit test nsis_install_is_not_managed in src-tauri/src/commands/app_update.rs pins exactly C:/Program Files/LogTapper/log-tapper.exe as not package-managed, so check 1's install path covers it.
• .github/workflows/verify-chocolatey.yml runs the script:
  • on PRs touching the package, the renderer, the script or the workflow;
  • on workflow_dispatch (defaults to the latest release);
  • via workflow_call.
    It renders with dummy DMG hashes (only the NSIS hash matters here), packs, tests, and uploads the tested .nupkg. There's a 30-minute timeout in case an installer dialog hangs, and it needs no secrets.
• publish-packages.yml: a new chocolatey-verify job calls that workflow for the version being released, and the chocolatey push job now depends on it. A package that doesn't install, reinstall and uninstall cleanly never reaches moderation.

Test plan

• Both workflows parse (js-yaml); every PowerShell block in them, plus the script and chocolateyuninstall.ps1, parses with the pwsh 7.6 AST parser (10 files, 0 errors)
• The tamper regex, run against a real render: exactly one character of checksum64 changes, for both a leading 0 and a leading letter; the rest of the file is identical
• This PR's Verify Chocolatey package run passes against v0.13.3. That run is the sandbox test for the first push.
• After merge: gh workflow run publish-packages.yml -f version=0.13.3 pushes the first version, with chocolatey-verify running before it

🤖 Generated with Claude Code