build the app, and ship it on Linux and Windows as well as macOS

The client itself: the sync engine and mirror, the Gmail and IMAP providers,
the screener, the three boxes and two piles, compose and send, the sanitiser
and tracker stripping, contacts, clips, backup, notifications and the guide.

The pipeline that ships it. Three runners now build in parallel and the
publish gate wants all four platform keys in latest.json before a release
leaves draft. Linux gets two more packages Tauri does not build: a flatpak
repackaged from the deb against GNOME 48, and a Nix package that relinks the
deb against nixpkgs so it runs as a native Wayland client rather than through
Xwayland. CI runs the Rust suite on all three desktops rather than on Linux
alone, and rebuilds the flatpak manifest on every push to main.

Two things that were only ever exercised on macOS and were wrong everywhere
else. The menu bar was built by adjusting the submenus macOS is given, so on
a platform whose default menu has no File or View the new File menu landed
after Edit, Check for Updates landed nowhere, and the three places and the
reading pane had no menu at all. The deb declared libwebkit2gtk-4.1-0 and
libgtk-3-0 twice, because tauri.conf.json named the dependencies Tauri
already emits.

The updater key exists now, so releases can sign their artifacts.

justfile

@@ -24,6 +24,11 @@ test:
 test-ui:
     pnpm test:ui
 
+# Recapture the pictures the guide ships with, from the fixture rather than from anybody's mailbox.
+# They are committed, so this is not part of `test-ui`: an ordinary run must not rewrite the tree.
+guide-shots:
+    GUIDE_SHOTS=1 pnpm exec playwright test tests/guide-shots.spec.ts
+
 # The prose gate: no em dashes, no broken relative links, no directory trees.
 docs:
     node scripts/docs-check.mjs
@@ -35,6 +40,18 @@ build:
     # The .app on macOS, the .deb and AppImage on Linux. No dmg: nothing here needs a disk image to
     # copy a bundle into place, and building one is the slowest part of a mac bundle.
     pnpm install
+    # macOS shows no notifications from a bundle that is not signed, so tauri.conf.json ad-hoc signs
+    # at minimum and a real identity replaces that when this machine has one: the signing directory
+    # holds an env file naming it, and Tauri reads APPLE_SIGNING_IDENTITY over the config.
+    if [ "$(uname -s)" = Darwin ]; then
+      signing="${MARGIN_SIGNING_DIR:-$HOME/.margin-signing}/studio.margin.app.env"
+      if [ -f "$signing" ]; then
+        set -a; . "$signing"; set +a
+        echo "Signing as $APPLE_SIGNING_IDENTITY"
+      else
+        echo "No $signing; the bundle will be ad-hoc signed."
+      fi
+    fi
     case "$(uname -s)" in
       Darwin) pnpm tauri build --bundles app ;;
       Linux)  pnpm tauri build --bundles deb,appimage ;;