Package DevinX Connector for Microsoft Store

[fenner888]

What changed

• Adds an exact-identity Microsoft Store MSIX pipeline for DevinX Connector on Windows 11 x64.
• Uses the Partner Center reservation DevinXTools.DevinXConnector, publisher CN=43D84E24-857C-4C40-9DAA-1A6983913CD9, Store ID 9N52Z3FVMFH8, and package family DevinXTools.DevinXConnector_ydtgrt4yd5wrc.
• Adds manifest, Store assets, deterministic packaging, checksum generation, and package-content verification.
• Uses the packaged Windows StartupTask API for opt-in launch at sign-in while preserving the registry fallback only for unpackaged development builds.
• Adds Microsoft Store install/update actions to mobile onboarding and hardens the assisted setup prompt against unsigned or unofficial Windows packages.
• Updates the public documentation, roadmap, release gates, and specs to distinguish Microsoft Store delivery from any future direct-download Authenticode path.

Why

Tailscale supplies only the private route. Windows users still need a trusted local Connector service. Microsoft Store delivery gives users a signed, updateable package without requiring DevinX to operate a paid Azure Artifact Signing service.

Validation

• npm run lint
• npm run typecheck
• full Jest suite (npm test -- --runInBand)
• npm run build
• npm audit --audit-level=high (0 vulnerabilities)
• npm run connector:verify:windows:store
• git diff --check

The Windows workflow must still compile the native app, create/unpack the real MSIX, and upload the MICROSOFT-STORE-UPLOAD artifact before this PR can leave draft.