build: wire desktop-bundle pipeline (CI matrix + per-platform installers)

Stand up the seamless-download path for non-technical buyers:

* .github/workflows/build.yml — matrix CI (mac/win/linux) that builds
  PyInstaller bundles and packages them per platform on tag push,
  attaching the resulting installers to a GitHub Release.
* build/installer.iss — Inno Setup script for the Windows installer
  (per-user install, optional desktop shortcut, runs on finish).
* build/macos/build_dmg.sh — wraps DataTools.app into a .dmg with a
  drag-to-/Applications layout.
* build/appimage/{AppRun,datatools.desktop,build.sh} — AppImage recipe.
* src/__init__.py — single source of truth for __version__; the spec
  reads it (was hardcoded), CI passes it through to all packagers.

Buyer download path now lives in the top-level README. Per-build
README documents the Phase 2 step (signing/notarization) that needs
the owner's Apple Developer + Windows code-signing credentials —
those are intentionally not in CI yet because they require setup
outside this repo.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

build/datatools.spec

@@ -34,6 +34,14 @@ from PyInstaller.utils.hooks import (
 # Repo root from this spec's location (PyInstaller sets SPECPATH).
 REPO = Path(SPECPATH).resolve().parent
 
+# Single source of truth for the version string. Read directly from
+# src/__init__.py instead of importing src/ — importing pulls in
+# heavy deps (pandas etc) that PyInstaller's spec parser doesn't need.
+import re as _re
+_init_py = (REPO / "src" / "__init__.py").read_text(encoding="utf-8")
+_m = _re.search(r'__version__\s*=\s*["\']([^"\']+)["\']', _init_py)
+VERSION = _m.group(1) if _m else "0.0.0"
+
 # ----- Hidden imports ------------------------------------------------
 # PyInstaller's static analyser misses everything Streamlit reaches
 # through ``importlib`` and the per-tool registries our app uses. We
@@ -142,8 +150,8 @@ if _sys.platform == "darwin":
         bundle_identifier="com.datatools.desktop",
         info_plist={
             "CFBundleDisplayName": "DataTools",
-            "CFBundleVersion": "1.0.0",
-            "CFBundleShortVersionString": "1.0.0",
+            "CFBundleVersion": VERSION,
+            "CFBundleShortVersionString": VERSION,
             "NSHighResolutionCapable": True,
             # Buyer's macOS will not show the app's window in the dock
             # if this is True. We want the dock icon so the buyer can