v4.3.0: package the desktop app with verifiable installers

publish.sh builds the GUI with the gui-release profile, names it zagan-bet-gui-<version>-<platform>-<arch>, and renders a bash and a PowerShell installer next to each app. Both embed the app's SHA-256, verify the file (or fetch it), install per-user and add a launcher: a desktop entry plus an SVG icon on Linux, a Start-menu shortcut on Windows.

The download page gains a Desktop app section with the apps and installers, keeps the terminal client and server, links the public git repository for the GPL source, and lists every file in the sha256sum block. deploy.sh verifies all four artifact kinds. Publishing refuses a dirty tree so the linked history matches the binaries.

1 files changed, 31 insertions, 12 deletions

diff --git a/web/README.md b/web/README.md
index e79abd4..bd87e11 100644
--- a/web/README.md
+++ b/web/README.md
@@ -1,15 +1,15 @@
 # Download page
 
-`index.php` scans `bin/client` and `bin/server` on every request and renders
-whatever builds it finds, with version, size and SHA-256. No database, no
-JavaScript, no CSS, no dependencies. The page is plain browser defaults:
-black text, blue links, monospace checksums. PHP 8.0+.
+`index.php` scans `bin/gui`, `bin/client` and `bin/server` on every request and
+renders whatever builds it finds, with version, size and SHA-256. No database, no JavaScript, no CSS, no dependencies. The page is plain
+browser defaults: black text, blue links, monospace checksums. PHP 8.0+.
 
 ## Layout
 
 ```
 web/
   index.php
+  bin/gui/       served at /bin/gui/... (app and installers)
   bin/client/    served at /bin/client/...
   bin/server/    served at /bin/server/...
 ```
@@ -22,13 +22,22 @@ The page only lists files that match the release pattern; anything else in
 those directories is ignored.
 
 ```
-zagan-bet-client-<version>-<platform>-<arch>[.exe]
-zagan-bet-server-<version>-<platform>-<arch>
+bin/gui/zagan-bet-gui-<version>-<platform>-<arch>[.exe]
+bin/gui/zagan-bet-gui-<version>-<platform>-<arch>-install.sh
+bin/gui/zagan-bet-gui-<version>-<platform>-<arch>-install.ps1
+bin/client/zagan-bet-client-<version>-<platform>-<arch>[.exe]
+bin/server/zagan-bet-server-<version>-<platform>-<arch>[.exe]
 ```
 
 `<version>` is `MAJOR.MINOR.PATCH`, `<platform>` is `linux`, `windows` or
 `macos`, `<arch>` is `x86_64`, `i686` or `aarch64`.
 
+The installers are generated next to their app. They embed the app's SHA-256,
+check the file (or download it) and install it for the current user: Linux
+writes `~/.local/bin/zagan-bet-gui` plus a `.desktop` launcher, Windows writes
+`%LOCALAPPDATA%\Programs\Zagan-Bet` plus a Start-menu shortcut. The source
+archives satisfy the GPL's corresponding-source requirement.
+
 ## Publishing a build
 
 From the repository root:
@@ -37,15 +46,21 @@ From the repository root:
 ./scripts/publish.sh
 ```
 
-It reads the version from `Cargo.toml`, builds all four artifacts and installs
-them under `web/bin` with the names above. Override the destination with
-`DEST=/srv/www/bin ./scripts/publish.sh`.
+It reads the version from `Cargo.toml`, builds every artifact and installs
+them under `web/bin` with the names above. The GUI is built with the
+workspace's `gui-release` profile (LTO, stripped) and the installers are
+rendered with Python 3 and the published SHA-256. Run it from a clean tree so
+the release commit is the source the page links to. Override the destination
+with `DEST=/srv/www/bin ./scripts/publish.sh`, and the download origin baked
+into the installers with `URL_BASE=https://staging.example/ ./scripts/publish.sh`.
+`ALLOW_DIRTY=1` skips the clean-tree check for a preview.
 
 Builds are per target triple, so these must be installed:
 `x86_64-unknown-linux-gnu`, `i686-unknown-linux-gnu` and
 `x86_64-pc-windows-gnu`, plus the mingw linker for the Windows build. Client
 builds always pass `--no-default-features`, which drops the server's OpenSSL
-dependency; the client is rustls-only.
+dependency; the client is rustls-only. The GUI needs Python 3 at publish time
+for the installer templates in `scripts/installers/`.
 
 Cargo itself cannot produce these names: it always writes
 `target/<triple>/release/<bin>`. The script renames after each build.
@@ -100,8 +115,9 @@ Then open <http://127.0.0.1:8899/>.
 ```
 
 `deploy.sh` rsyncs `web/` with `--delay-updates`, so a visitor never sees a
-half-written binary, then fetches the live page and every artifact it lists and
-compares the downloaded bytes with the local SHA-256. `--verify-only` skips the
+half-written binary, then fetches the live page and every artifact it lists —
+GUI apps, installers, terminal clients and servers — and compares the
+downloaded bytes with the local SHA-256. `--verify-only` skips the
 upload and only checks the live site. Old versions are left on the server;
 prune them by hand.
 
@@ -124,3 +140,6 @@ php -S 127.0.0.1:8899 -t /srv/staging
   stay downloadable until you remove them from `bin/`.
 - The checksum block is in `sha256sum` format, so visitors can save it as
   `SHA256SUMS` and run `sha256sum -c SHA256SUMS`.
+- The page links <https://git.2137697.xyz/zagan-bet.git> for the GPL
+  corresponding source; publish only from a committed release so that link
+  contains the exact source.