Add PyInstaller packaging and tufup-based auto-update pipeline

Full pipeline, verified end-to-end against the real installed tufup
0.10.0 API (initial docs/summaries turned out inaccurate in places —
e.g. the apply method is download_and_apply_update, not update;
confirmed by inspecting installed package source directly rather than
trusting docs alone):

- core/version.py: single-source app version constant.
- labdaq.spec: PyInstaller onedir build (must be onedir, not onefile —
  tufup replaces individual files in the install dir on update).
  Bundles ui/*.qss, plugins/ (needed for runtime plugin discovery), and
  repository/metadata/root.json once repo_init.py has produced one.
  Built and smoke-tested: the frozen exe launches and stays running.
- scripts/release/{repo_init,repo_release}.py: maintainer-run release
  tooling using tufup.repo.Repository, manual local signing (keys never
  touch CI). Both actually run end-to-end during development of this
  feature against a real build, not just written and assumed correct.
  Longer expiration_days than tufup-example's CI-oriented defaults
  (targets/snapshot/timestamp 90d instead of 7d/7d/1d), since we're
  signing manually, not on an automated daily schedule — see
  scripts/release/README.md for the re-signing cadence this still
  requires even between releases.
- core/updater.py: thin Client wrapper. Refuses to run outside a
  frozen build (getattr(sys, "frozen", False)) since there's no
  installed bundle for tufup to update in `python main.py` dev mode.
  Bootstraps the bundled root.json into the metadata cache dir on
  first run — tuf.ngclient.Updater loads root.json from local disk on
  construction, it does not fetch it remotely by design (the root of
  trust can't come from the same server being verified).
- core/app_settings.py: factored out app_data_dir() (was inline in
  _settings_path()) so the updater's metadata/target cache dirs live
  in the same per-user location as settings.json, deliberately outside
  the install directory an update can replace/move.
- Settings > General: version display + "Check for Updates" button,
  manual-only per discussion (no silent background network calls or
  surprise restarts for a lab-instrument-control app).

Metadata/targets are hosted on this repo's "updates" GitHub Release —
a fixed tag, not a normal per-version tag, because TUF's top-level
metadata needs a stable URL across app versions. No such GitHub-Releases-
hosting example exists in tufup or tufup-example; verified this by
fetching tufup-example's actual GitHub Actions workflow file directly
after a web search wrongly suggested one existed — the design here is
ours, not copied from upstream.

Not yet done, deliberately left for the user: running repo_init.py for
real (generates production signing keys), and creating the actual
"updates" GitHub Release. Both are irreversible-ish, security-sensitive,
externally-visible actions outside what should happen without the
user directly driving them.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

1 files changed, 72 insertions, 0 deletions

diff --git a/labdaq.spec b/labdaq.spec
new file mode 100644
index 0000000..635af06
--- /dev/null
+++ b/labdaq.spec
@@ -0,0 +1,72 @@
+# labdaq.spec
+#
+# PyInstaller build spec. Build with:
+#   pyinstaller labdaq.spec
+#
+# Output: dist/LabDAQ/LabDAQ.exe (onedir build — required, not onefile:
+# tufup replaces individual files in the install directory on update,
+# which a single-file onefile exe can't do).
+
+import sys
+from pathlib import Path
+
+block_cipher = None
+
+root_dir = Path(SPECPATH)
+
+# root.json is generated by scripts/release/repo_init.py — bundle it once it
+# exists so a fresh install can bootstrap tufup trust without an insecure
+# first fetch. Skip silently before that's ever been run (e.g. first build).
+datas = [
+    (str(root_dir / "ui" / "style_dark.qss"), "ui"),
+    (str(root_dir / "ui" / "style_light.qss"), "ui"),
+    (str(root_dir / "ui" / "style.qss"), "ui"),
+    (str(root_dir / "plugins"), "plugins"),
+]
+_root_json = root_dir / "scripts" / "release" / "repository" / "metadata" / "root.json"
+if _root_json.exists():
+    datas.append((str(_root_json), "repository/metadata"))
+
+a = Analysis(
+    ["main.py"],
+    pathex=[str(root_dir)],
+    binaries=[],
+    datas=datas,
+    hiddenimports=[],
+    hookspath=[],
+    hooksconfig={},
+    runtime_hooks=[],
+    excludes=[],
+    win_no_prefer_redirects=False,
+    win_private_assemblies=False,
+    cipher=block_cipher,
+    noarchive=False,
+)
+pyz = PYZ(a.pure, a.zipped_data, cipher=block_cipher)
+
+exe = EXE(
+    pyz,
+    a.scripts,
+    [],
+    exclude_binaries=True,
+    name="LabDAQ",
+    debug=False,
+    bootloader_ignore_signals=False,
+    strip=False,
+    upx=True,
+    console=False,
+    disable_windowed_traceback=False,
+    target_arch=None,
+    codesign_identity=None,
+    entitlements_file=None,
+)
+coll = COLLECT(
+    exe,
+    a.binaries,
+    a.zipfiles,
+    a.datas,
+    strip=False,
+    upx=True,
+    upx_exclude=[],
+    name="LabDAQ",
+)