build: add single-command release script + portable zip artifacts

One-developer workflow: ``python build/make_release.py`` on each
target OS produces both the installer and a portable .zip for that
platform. Preflight checks PyInstaller / Pillow / iscc / hdiutil /
ditto / appimagetool and bails with install hints if anything is
missing — no half-built dist/.

New scripts:
- build/make_release.py   — orchestrator, auto-detects host OS.
- build/generate_icons.py — icon.ico / icon.icns / icon.png from
  src/gui/assets/datatools_icon_256.png (Pillow ships ICO + ICNS
  writers; no platform tooling needed).
- build/build_portable_zip.py — Win/Linux portable zip via stdlib.
- build/macos/build_zip.sh — Mac portable .app via ditto so
  bundle metadata survives.

installer.iss now adds: Quick Launch task (opt-in, legacy Win 7),
App Paths registry entry (Win+R "DataTools" works), SetupIconFile,
UninstallDisplayIcon, AppSupportURL, AppUpdatesURL.

CI workflow uploads installer + portable per platform and attaches
both to GitHub Releases on tag push.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

build/macos/build_zip.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Wrap dist/DataTools.app into a no-install portable .zip.
+#
+# Usage:
+#   bash build/macos/build_zip.sh <version>
+#
+# Why a portable .zip in addition to the .dmg:
+#   * Buyers who don't want an installer can unzip and double-click the
+#     .app directly — no drag-to-/Applications step, no installer
+#     chrome. Self-contained: the .app holds Python + every dep.
+#   * IT-locked-down machines often block .dmg auto-mount but allow
+#     .zip download + extraction.
+#
+# Run after ``pyinstaller build/datatools.spec --clean --noconfirm``
+# has produced ``dist/DataTools.app``. Output goes to
+# ``dist/DataTools-<version>-mac-portable.zip``.
+
+set -euo pipefail
+
+VERSION="${1:-0.0.0-dev}"
+APP="dist/DataTools.app"
+ZIP="dist/DataTools-${VERSION}-mac-portable.zip"
+
+if [[ ! -d "$APP" ]]; then
+  echo "Error: $APP not found. Run pyinstaller build/datatools.spec first." >&2
+  exit 1
+fi
+
+# ``ditto`` preserves the .app bundle's extended attributes and
+# resource forks (a plain ``zip`` strips them and can break code
+# signatures + Info.plist resolution on the buyer's machine).
+#
+# --sequesterRsrc keeps the AppleDouble metadata inside the archive
+# rather than as parallel ._ files on disk after extraction.
+rm -f "$ZIP"
+ditto -c -k --sequesterRsrc --keepParent "$APP" "$ZIP"
+
+echo "Built $ZIP ($(du -h "$ZIP" | cut -f1))"