v4.3.0: package the desktop app with verifiable installers

publish.sh builds the GUI with the gui-release profile, names it zagan-bet-gui-<version>-<platform>-<arch>, and renders a bash and a PowerShell installer next to each app. Both embed the app's SHA-256, verify the file (or fetch it), install per-user and add a launcher: a desktop entry plus an SVG icon on Linux, a Start-menu shortcut on Windows.

The download page gains a Desktop app section with the apps and installers, keeps the terminal client and server, links the public git repository for the GPL source, and lists every file in the sha256sum block. deploy.sh verifies all four artifact kinds. Publishing refuses a dirty tree so the linked history matches the binaries.

1 files changed, 6 insertions, 0 deletions

diff --git a/AGENTS.md b/AGENTS.md
index 368a348..7258710 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -85,6 +85,12 @@
 - The embedded fonts have no suit or arrow glyphs. Draw card suits as shapes
   and use plain words for navigation; a glyph that is not in Open Sans or Hack
   renders as tofu.
+- `scripts/publish.sh` builds the GUI with `gui-release` and renders the
+  installers with the published SHA-256. Installers verify the hash and install
+  per-user; never install system-wide or skip the check.
+- The download page links the public git repository
+  (https://git.2137697.xyz/zagan-bet.git) for the GPL corresponding source.
+  Run publish from a clean tree so the linked history matches the binaries.
 
 ## Client TUI
 - `render_lines()` and `render()` must agree. If `render()` uses `\r\n`,