Harden cross-platform release pipeline

[merefield]

Summary

• add and test a checksum-validating PowerShell installer for existing Windows release artifacts
• run CI and release checks across Linux, macOS, and Windows while avoiding duplicate feature-branch push runs
• make VERSION the maintained release version and require release tags to match it
• remove duplicated current-version literals from build fallbacks and test fixtures
• harden Unix installation replacement and strict SemVer validation
• update the README and Meta topic for Windows installation and the release process

Verification

• make check
• Windows AMD64 cross-build
• 10 Bats installer tests
• focused Go and UI tests

[Copilot]

🟡 Changes recommended

The PowerShell installer/tests use -UseBasicParsing while workflows run under pwsh, and the maintained VERSION conflicts with updated docs/examples, risking CI failures and stale installation guidance.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR hardens the cross-platform CI/release pipeline by adding a checksum-validating Windows PowerShell installer, expanding CI/release test execution across Linux/macOS/Windows, and making VERSION the single maintained source of truth for releases (with tag validation).

Changes:

• Added a Windows install-release.ps1 installer plus a PowerShell-based installer test harness, and expanded installer test coverage (Unix + Windows).
• Updated version resolution to embed VERSION in the Go binary and removed build/version fallbacks that duplicated the “current” version.
• Reworked CI and release workflows to validate tags against VERSION and run cross-platform checks while reducing duplicate runs.

File summaries

File	Description
VERSION	Introduces maintained source-of-truth version file embedded into the binary.
termcourse.go	Embeds VERSION via go:embed and uses it as the fallback version source.
termcourse_test.go	Updates version tests to avoid coupling to a specific maintained version constant.
Makefile	Removes hard-coded version fallback and only injects build version when git describe succeeds.
install-release.sh	Adds strict SemVer tag validation and stages executable replacement more safely.
install-release.ps1	Adds a checksum-validating Windows installer with version and archive validation.
test/install-release.bats	Updates Unix installer fixtures and adds tests for SemVer rejection + directory-target handling.
test/install-release.ps1	Adds Windows installer integration-style tests using a local fixture HTTP server.
README.md	Documents Windows installation and updates release/versioning guidance.
meta-topic.md	Updates the meta topic with Windows installer instructions and release notes.
internal/ui/ui_test.go	Decouples UI tests from the maintained version value by using a non-current version literal.
internal/theme/theme_test.go	Makes config-path tests OS-aware (darwin/windows/xdg).
.github/workflows/ci.yml	Expands CI to a Linux/macOS/Windows matrix and adds installer checks.
.github/workflows/release.yml	Separates tag validation from testing, enforces tag==VERSION, and runs cross-platform tests before publish.

Review details

• Files reviewed: 14/14 changed files
• Comments generated: 4
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.