ci: migrate Windows Store publishing from StoreBroker to msstore-cli

[davidanthoff]

Summary

Replaces the archived StoreBroker PowerShell module with the MSStore Developer CLI (installed via the official microsoft/microsoft-store-apppublisher setup action, latest tag v1.4) for all three Windows Store deploy channels, and renames the MSIX outputs to modern .msixbundle/.msix extensions. Microsoft archived the old store-submission action on 2026-08-24 and points at msstore-cli as the replacement; StoreBroker has repeatedly broken our releases (see the CHANGELOG "Force old PowerShell version" workarounds, whose dead commented-out blocks are also removed here).

Changes

• package-windows-msix: drops the StoreBroker install and the New-SubmissionPackage payload step; the storepackage artifact is now the raw .msixbundle produced by cargo msix.
• Deploy jobs (deploy-dev-channel-winstore, deploy-releasepreview-channel-winstore, deploy-release-channel-winstore): install msstore-cli via the setup action, then run msstore reconfigure + msstore publish. msstore publish replaces packages, commits, and polls ingestion in one command, replacing Update-Application(Flight)Submission -ReplacePackages -AutoCommit -Force + Start-SubmissionMonitor. The 3-attempt/60s retry loop is kept.
• Extension rename: PackagingLayout.xml now names the bundle Julia-<ver>.0.msixbundle and the inner per-arch packages .msix (the formats are byte-identical — MSIX is the modern name for the same container; msstore-cli only accepts .msix/.msixbundle/.msixupload, verified in its source). The MainBundle Uri in Julia.appinstaller changes in lockstep. Compatibility: the appxmanifest requires Windows 10 1803+ and .msix extensions are supported from 1709; old S3 objects remain in place for clients mid-update. VCLibs dependency entries are intentionally untouched (Microsoft ships those as .appx only).
• Listing metadata: deploy/winstoresubmission/ (SBConfig.json, PDP.xml, screenshot) is deleted. msstore-cli has no PDP support; the store listing is now managed directly in Partner Center, and CI submissions are packages-only (which preserve the existing published listing).

Required before merging / next tagged release

• Add a SELLERID secret (Partner Center → Account settings → Identifiers → Seller ID) to the dev-channel, release-preview-channel, and release-channel environments. TENANTID/CLIENTID/CLIENTSECRET are reused unchanged.
• Confirm the live Partner Center listing (description/screenshot) is up to date, since the PDP files are removed from the repo.
• Confirm the Entra app (CLIENTID) is associated in Partner Center → User management → Microsoft Entra applications with the Manager role (it should already be, StoreBroker uses the same API).

Follow-up: federated (OIDC) auth

msstore-cli gained client-assertion auth in microsoft/msstore-cli#145 (merged 2026-08-29), but the latest release (v0.4.1, 2026-08-20) does not include it yet. Once a release ships with it, a follow-up PR can drop CLIENTSECRET: add id-token: write to the deploy jobs, mint a GitHub OIDC token with audience api://AzureADTokenExchange into MSSTORE_CLIENT_ASSERTION, switch to msstore reconfigure --clientAssertion, and add federated credentials on the Entra app for the three deploy environments.

Verification

• actionlint passes on the edited workflow (the one remaining warning, matrix.label at line 414, is pre-existing from the rust-cache change).
• msstore-cli flag names (reconfigure --tenantId/--sellerId/--clientId/--clientSecret, publish --appId/--flightId) and the accepted package extensions were verified against the msstore-cli source; cargo-msix passes the PackagingLayout.xml filenames through to makeappx untouched (verified in its source).
• PackagingLayout.xml and Julia.appinstaller agree exactly on Julia-{{Version}}.0.msixbundle; no appxbundle references remain outside .gitignore.
• Real end-to-end validation happens on the next tagged release; watch the package-windows-msix job (bundle build) and the dev-channel flight, which limits blast radius.

🤖 Generated with Claude Code

[davidanthoff]

I'll wait with merging this until we got a new build out with the new system for Windows, as this might take a while to really polish and we should presumably first catch up on things.