v4.3.0: package the desktop app with verifiable installers

publish.sh builds the GUI with the gui-release profile, names it zagan-bet-gui-<version>-<platform>-<arch>, and renders a bash and a PowerShell installer next to each app. Both embed the app's SHA-256, verify the file (or fetch it), install per-user and add a launcher: a desktop entry plus an SVG icon on Linux, a Start-menu shortcut on Windows.

The download page gains a Desktop app section with the apps and installers, keeps the terminal client and server, links the public git repository for the GPL source, and lists every file in the sha256sum block. deploy.sh verifies all four artifact kinds. Publishing refuses a dirty tree so the linked history matches the binaries.

2 files changed, 38 insertions, 10 deletions

diff --git a/docs/GUI-PLAN.md b/docs/GUI-PLAN.md
index 89cf495..f058e41 100644
--- a/docs/GUI-PLAN.md
+++ b/docs/GUI-PLAN.md
@@ -162,18 +162,29 @@ Measured on Linux at 1080p with llvmpipe software GL:
 **Gate:** the screenshot set is ready for review. Remaining for the gate:
 frame rate on integrated graphics and the Windows interactive pass.
 
-## Phase 5 — packaging
-## Phase 5 — packaging
-
-- `publish.sh` emits `zagan-bet-gui-<version>-<platform>-<arch>[.exe]`.
-- Bash and PowerShell installers that verify the SHA-256, install to the user
-  directory, and create `.desktop`/Start-menu entries.
-- Download page lists raw binaries and installers; add the source-code link.
-
-**Gate:** `deploy.sh` verifies both artifact kinds; a clean machine installs
-from the page and launches.
+## Phase 5 — packaging (code complete, v4.3.0)
+
+- `publish.sh` builds the GUI with the `gui-release` profile for Linux and
+  Windows and names the app `zagan-bet-gui-<version>-<platform>-<arch>[.exe]`.
+- It renders a bash installer and a PowerShell installer next to each app.
+  Both embed the app's SHA-256, verify the file (or download it), install
+  per-user and add a launcher: `.desktop` plus an SVG icon on Linux, a
+  Start-menu shortcut on Windows. Templates live in `scripts/installers/`;
+  `render-installer.py` fills them in.
+- The download page scans `bin/gui`, `bin/client` and `bin/server`, lists
+  apps, installers, clients and servers, and includes every file in the
+  `sha256sum` block. A Source section links the public git repository
+  (<https://git.2137697.xyz/zagan-bet.git>) for the GPL corresponding source.
+  `deploy.sh` verifies every artifact kind over the public URL.
+- `publish.sh` refuses to run from a dirty tree so the linked history matches
+  the binaries.
+
+**Gate:** deploy verification passes for apps, installers, clients and
+servers; the Linux installer is exercised in a clean HOME. The Windows
+installer needs a Windows machine before the gate closes.
 
 ## Testing split
+## Testing split
 
 - `View`/`Command` tests in the core: flows, gating, state. Always.
 - The TUI adapter remains the regression net through Phases 1–2.
diff --git a/docs/TESTING.md b/docs/TESTING.md
index 613cd08..c32ac22 100644
--- a/docs/TESTING.md
+++ b/docs/TESTING.md
@@ -266,3 +266,20 @@ terminal client; a saved login from one signs in the other.
   the row is upgraded to bcrypt.
 - Spin several times and confirm `plays` grows by one row per spin while
   `users.balance` changes by `winnings - bet`.
+
+## Packaging checklist
+
+1. Set the version in `Cargo.toml` and `gui/Cargo.toml` (same MAJOR.MINOR),
+   run `cargo test --workspace`, and commit. `publish.sh` refuses a dirty tree
+   because the site links the committed git history as the GPL source.
+2. `./scripts/publish.sh` (add `DEST=` and `URL_BASE=` to stage elsewhere). It
+   builds the GUI with `gui-release`, the terminal clients and servers, and
+   renders the bash/PowerShell installers with each app's SHA-256.
+3. `php -S 127.0.0.1:8899 -t <staging>` and
+   `./scripts/deploy.sh <staging> http://127.0.0.1:8899/` to upload and verify
+   every app, installer, client and server against the page's checksums.
+4. On a clean user account: download an app with its installer, run the
+   installer, and launch the new menu entry. The installer must refuse a
+   corrupted download.
+5. Repeat on Windows for the `.ps1` installer and the Start-menu shortcut.
+