Add Store MSIX packaging and dark/light theme for 2.9.0.

EOF

Co-authored-by: Cursor <cursoragent@cursor.com>

packaging/msix/README.md

@@ -0,0 +1,45 @@
+# MSIX packaging for Navis (Microsoft Store)
+
+Navis ships as a **full-trust Win32 + WebView2** app. Prefer **MSIX** over a PWA:
+system proxy and protocol cores cannot be delivered as a Store PWA alone.
+
+## Prerequisites
+
+1. Build Windows binaries: `build.bat` → `dist\navis-release\windows\Navis.exe`
+2. [Windows SDK](https://developer.microsoft.com/windows/downloads/windows-sdk/) with `MakeAppx.exe` (and `SignTool.exe` for sideload signing)
+3. Optional: a code-signing certificate whose **Subject CN** matches `Identity/@Publisher` in `AppxManifest.xml`
+
+## Pack
+
+From the repo root (PowerShell):
+
+```powershell
+.\scripts\pack-msix.ps1
+```
+
+Options:
+
+```powershell
+.\scripts\pack-msix.ps1 -ExePath "dist\navis-release\windows\Navis.exe" -Version "2.9.0.1"
+.\scripts\pack-msix.ps1 -Publisher "CN=Your Store Publisher" -Name "EvilFox.Navis"
+.\scripts\pack-msix.ps1 -CertPath ".\certs\navis-msix.pfx" -CertPassword "..."
+```
+
+Output: `dist\navis-release\windows\Navis_<version>.msix`
+
+## Store submission
+
+1. Create the app in [Partner Center](https://partner.microsoft.com/dashboard).
+2. Copy **Package/Identity Name** and **Publisher** into `AppxManifest.xml` (or pass `-Name` / `-Publisher` to the script).
+3. Upload the `.msix` (Partner Center can re-sign with the Store cert).
+4. Declare **runFullTrust** and network capabilities; answer Store questions about VPN/proxy use.
+5. Privacy policy URL required (document system-proxy changes and outbound tunnel traffic).
+6. **Do not enable in-app self-update** for Store builds — Navis detects MSIX package identity and hides the updater (Store updates only).
+
+## Sideload test
+
+```powershell
+Add-AppxPackage -Path .\dist\navis-release\windows\Navis_2.9.0.1.msix
+```
+
+Unsigned packages need a trusted cert or developer mode / sideloading enabled.