Restructure release infra for multiple platforms; migrate real win keys

PyInstaller doesn't cross-compile and TUF metadata filenames aren't
platform-prefixed, so a shared updates/ release and repo tree can't
safely hold more than one OS's build — a second platform's publish
would silently overwrite the first's trust root and metadata.

- scripts/release/repo_init.py, repo_release.py: auto-detect platform
  (win/mac/linux) and operate inside scripts/release/<platform>/ instead
  of a flat scripts/release/ tree.
- labui.spec: bundles root.json from this platform's own tree.
- core/updater.py: points at releases/download/updates-<platform>/
  instead of a single shared updates/ tag.
- Moved the existing real keystore/repository/config (already used for
  a live Windows release) from the old flat path into
  scripts/release/win/ — same keys, same signed metadata, just
  relocated. No new keys generated, existing installs still trust it.
- .gitignore updated for the per-platform paths, plus temporary rules
  covering the old flat path during migration.
- docs/building.md, scripts/release/README.md: rewritten for the
  per-platform flow, including a note that Linux builds should happen
  on Linux/WSL2 (no cross-compiling) and that a bare .exe doesn't
  belong on the updates-<platform> release — only the TUF metadata +
  signed target archive do.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

1 files changed, 0 insertions, 71 deletions

diff --git a/scripts/release/repository/metadata/root.json b/scripts/release/repository/metadata/root.json
deleted file mode 100755
index 343b2e2..0000000
--- a/scripts/release/repository/metadata/root.json
+++ /dev/null
@@ -1,71 +0,0 @@
-{
- "signatures": [
-  {
-   "keyid": "25e91fe88ce247418835d22b18c63a8166038a16b2b9f26f319bc65a8b2687ed",
-   "sig": "cb0c1b0078781b4b87a181deaa03122a7e1f08dd39fab4eac842acd43397e0c5b268009825fa942e86b368b4edd651e69967182981e8be746a60566b42d36109"
-  }
- ],
- "signed": {
-  "_type": "root",
-  "consistent_snapshot": false,
-  "expires": "2027-08-01T23:55:23Z",
-  "keys": {
-   "25e91fe88ce247418835d22b18c63a8166038a16b2b9f26f319bc65a8b2687ed": {
-    "keytype": "ed25519",
-    "keyval": {
-     "public": "be8f719618189eb74b524ee92e85eea99a5228fafc7257356b5d8acad2829b24"
-    },
-    "scheme": "ed25519"
-   },
-   "40e5301cd4b92e4a9c2e63dcca99ffa4a5627c25ac6c254f272bb52c9a076cfc": {
-    "keytype": "ed25519",
-    "keyval": {
-     "public": "cbde8cdde12b19b39a786da7128214d01e0f4415e590df34768530fad2bf4702"
-    },
-    "scheme": "ed25519"
-   },
-   "4edf46a4cf08f9b2c59cbe9a435024a8498ce68cc63208f1fbb8b69e74768d42": {
-    "keytype": "ed25519",
-    "keyval": {
-     "public": "1559cdea5a3295593d4c08e6ee625561f7cd96a1dcc0d553b9961734491b801a"
-    },
-    "scheme": "ed25519"
-   },
-   "998b28525eec351c6cdd16d6da3854876e84ab450595feac782ae83d3a8226d6": {
-    "keytype": "ed25519",
-    "keyval": {
-     "public": "6ac7a3b9d83f0d1835ea6fdc0307fe340ea422bc15763fdc0bc197383a61d79b"
-    },
-    "scheme": "ed25519"
-   }
-  },
-  "roles": {
-   "root": {
-    "keyids": [
-     "25e91fe88ce247418835d22b18c63a8166038a16b2b9f26f319bc65a8b2687ed"
-    ],
-    "threshold": 1
-   },
-   "snapshot": {
-    "keyids": [
-     "40e5301cd4b92e4a9c2e63dcca99ffa4a5627c25ac6c254f272bb52c9a076cfc"
-    ],
-    "threshold": 1
-   },
-   "targets": {
-    "keyids": [
-     "998b28525eec351c6cdd16d6da3854876e84ab450595feac782ae83d3a8226d6"
-    ],
-    "threshold": 1
-   },
-   "timestamp": {
-    "keyids": [
-     "4edf46a4cf08f9b2c59cbe9a435024a8498ce68cc63208f1fbb8b69e74768d42"
-    ],
-    "threshold": 1
-   }
-  },
-  "spec_version": "1.0.31",
-  "version": 1
- }
-}
\ No newline at end of file