Submit a release's MSI to the Microsoft Store from a workflow

[fstubner]

Each release needs a new Store submission whose package URL names that release's MSI. This adds a hand-run workflow that does it through the Store submission API.

scripts/release/msstore-submit.sh <tag>:

1. checks netscli.com/download/<tag>/…msi answers 200 with no redirect
2. stops if a submission is still in certification
3. rewrites packageUrl on the draft's packages, keeping every other field, and commits them
4. waits for the draft to be ready, then submits

It does not wait for certification.

msstore-submit_test.sh runs it against a fake curl in CI (next to lib_test.sh), covering the happy path, call order, a redirecting URL, an in-progress submission, an API error and a draft that never becomes ready.

Not verified

• Never run against the real API. It needs the Entra app and five secrets described in docs/MICROSOFT-STORE.md section 5, which only the account owner can create.
• Which ID the API wants as the product ID is not stated in Microsoft's docs. The doc says which to try first.
• The test needs jq, which this machine lacks, so its first run is in CI.

Inert until the secrets exist: the workflow only runs on workflow_dispatch.