choco-setuplisted

# Chocolatey Distribution Setup Take a repository from "builds a Windows binary" to "users run `choco install <pkg>`", doing as much as possible automatically. The goal is **zero manual steps** for the user where the tooling allows it (`gh` sets the API-key secret, downloads release assets, dispatches the publisher; the skill generates the package, packs it, and verifies a real local install). The one step the tooling genuinely cannot do for the user is **obtain the Chocolatey account + API key** — that requires a human signup at chocolatey.org. Make that the single copy-paste, and treat it as the security-sensitive decision (see Operating principles). Work on a dedicated branch and offer to merge at the end. ## Operating principles - **Verify, don't assume.** Never tell the user "it works" until `scripts/verify-choco-package.ps1` passes: a real `choco pack` + local `choco install` from the produced `.nupkg`, the binary actually runs, and `choco uninstall` cleans up. We confirm what a real user's `choco install` sees. - **Minimize intervention.** Prefer `gh` automation over hand instructions. Only fall back to manual when a capability is missing (no `gh` auth) or is inherently human (creating the chocolatey.org account and copying the API key). - **Ask only on security.** If anything blocks, resolve it yourself from sensible defaults — *except* decisions that affect security (handling the API key, what binary gets downloaded/embedded, checksum policy). For t