Complete portable-package integration and release hardening

[emsi]

Problem

Tagged workflows publish Flatpak and AppImage artifacts with AppStream metadata, icons, checksums, bundled extraction tooling, notices, and corresponding source. MIME integration, portal behavior, reproducibility, signing, update guidance, and cross-distribution validation remain incomplete.

Acceptance criteria

• Flatpak tests cover portal-granted notebook trees, default library access, attachments, and offline .onepkg import.
• Desktop MIME associations open supported OneNote source types predictably.
• AppImage tests cover the documented distribution matrix and runtime licenses.
• Repeated builds are compared for reproducibility or documented variance.
• Artifacts and checksums are signed with verification instructions.
• Upgrade, reinstall, rollback, and removal instructions are verified.
• AppStream and desktop metadata validators run in CI.