feat: make Snaply release-ready

[P4suta]

Summary

• Reduce Snaply to one polished capture flow: region, window, or desktop capture → PNG autosave + clipboard, with zoom and open-folder affordances.
• Replace fragmented capture/output ownership with explicit pipelines, deterministic disposal, device-loss recovery, and tested view-model behavior.
• Remove unfinished/dead UI, theme layers, assets, APIs, and documentation; tighten localization, accessibility, branding, dependencies, packaging, and public surface.
• Make release claims executable through x64/ARM64 packaging, reproducibility checks, SBOM verification, pinned Actions, canonical GitHub settings, and REUSE 3.3 compliance.

Why

The previous implementation mixed incomplete product paths with stale release assumptions and documentation-only safeguards. This change makes the minimal product contract explicit in code and turns release, supply-chain, licensing, and repository policy expectations into automated gates.

Impact

• Smaller and more predictable product surface.
• Capture results are saved and copied without an extra export workflow.
• No telemetry, network capability, or unused public API is added.
• Release artifacts cover x64 and ARM64; signed publishing remains intentionally blocked until the real certificate publisher and signing secrets are configured.

Root causes addressed

• Capture resources and output lifetime were split across UI and service layers.
• Packaging, SBOM, reproducibility, and GitHub policy were not enforced end-to-end.
• Dead controls, theme abstractions, assets, and docs obscured the actual product contract.
• Licensing metadata was not machine-verifiable.

Linear

Release-readiness progress is tracked on the Snaply Linear project. No issue-closing identifier is invented for this repository-wide hardening change.

Verification

• 80/80 tests pass (61 pure + 19 app tests)
• Pure library coverage: 187/187 lines and 74/74 branches (100%)
• x64 and ARM64 trimmed/ReadyToRun portable builds and unsigned MSIX/bundle, 0 warnings
• Two clean release builds produced 1,224 byte-identical payload entries
• SPDX 2.2 SBOM: 48 packages / 7 artifacts, 0 missing, additional, or hash mismatches
• Vulnerability scan: 0 findings
• dotnet format Snaply.slnx --verify-no-changes --no-restore
• actionlint
• PowerShell, JSON, XML, and XAML parsing
• reuse lint — REUSE Specification 3.3 compliant, 116/116 files annotated
• Staged-secret scan: 0 findings
• Lock files updated; no unused feature, public API, capability, or dependency added

External release gates

• Configure MSIX_PUBLISHER to exactly match the real production signing certificate subject, then provide signing secrets.
• Enable Windows Developer Mode and run the packaged UI/accessibility/soak/startup/idle gate on a release machine.