Package and release the replacement client for Linux and Windows

[zoeyrose]

Outcome

Publish installable, independently upgradable client releases containing only approved code/assets and no source-checkout assumptions.

Scope and invariants

• Package the Rust binary, approved runtime libraries, renderer/shaders/fonts, exact allowlisted bootstrap assets, default config, licenses/notices, SBOM, provenance, checksums, and crash-symbol policy.
• Define installation, per-user data/cache/log/secret paths, upgrade/downgrade/reinstall/uninstall behavior, and compatibility with server/protocol/content/resource release ranges.
• Exercise Vulkan/Linux and D3D12/Windows on clean machines plus documented fallback/diagnostics.
• Keep editor/toolkit/write-capable dependencies out of client packages.
• Define update notification/download ownership without executing untrusted code or silently changing server identity.

Acceptance criteria

• Packages install/run from a clean host with no Rust, compiler, source tree, classic DLL/library, Python, or editor.
• License/asset audit fails on anything absent from the exact allowlist.
• Smoke tests cover first run, login/play/reconnect, upgrade preserving state, corrupt cache recovery, clean reinstall, and uninstall data policy.
• Artifacts are reproducible or variance is documented; release contains checksums, SBOM, provenance, notices, and version manifest.
• Website/wrapper consume immutable release coordinates rather than reconstructed URLs.

Dependencies and parallelization

Depends on M5 parity, renderer releases, protocol compatibility, resource/sound provenance, and server release candidate. Packaging automation can start against M3 snapshots.

Licensing

Client code/tests are MIT. Legacy reuse requires an audited approved-grantor grant; all other implementation is independent. Content, sound, and graphics retain their exact asset licenses and notices.