Submit stable releases to both app stores

[ComputelessComputer]

Reuse the store publishing workflow from desktop publish and require both platforms for every future stable release.

---

Note

Medium Risk
Changes the stable release pipeline to automatically submit to App Store Connect and the Microsoft Store and forward many production secrets; misconfiguration could block releases or submit the wrong build.

Overview
Stable desktop publish runs now require Windows (include_windows must be true) so Microsoft Store submission can always run, and add a store-publish job after gh-release that calls desktop_store_publish.yaml via workflow_call with both macOS and Windows enabled and submit_to_stores: true.

desktop_store_publish.yaml is extended with a workflow_call entry (version, candidate SHA, platform flags, submit flag) and optional secret declarations so the publish workflow can invoke it without secrets: inherit, forwarding a fixed set of store and build secrets explicitly.

desktop-release-provenance.test.mjs adds coverage that the Windows gate, reusable store workflow, store-publish job wiring, and declared vs forwarded secrets stay aligned.

^{Reviewed by Cursor Bugbot for commit fd15bea. Bugbot is set up for automated code reviews on this repo. Configure here.}

[netlify]

✅ Deploy Preview for anarlog canceled.

Name	Link
🔨 Latest commit	fd15bea
🔍 Latest deploy log	https://app.netlify.com/projects/anarlog/deploys/6a8cfbaca823d90008eff8a0