Amazon Music RPC v5 trust and architecture rewrite

[eripum9]

Summary

• replaces the release process with a manually triggered, hash-locked draft-release workflow
• hardens updater downloads, Amazon Music DevTools attachment, Amazify localhost integration, and secret storage
• introduces typed runtime state, explicit controllers, supervised task ownership, and structured redacted logs
• adds network controls and diagnostics transparency, updates the setup/settings experience, and aligns the app at v5.0.0
• documents architecture, threat boundaries, network endpoints, privacy, security, and maintainer release procedures

Verification

• 66 pytest tests passed
• 46 built-in self-tests passed
• Pyright: 0 errors
• Ruff safety checks passed
• pip-audit found no known vulnerabilities
• actionlint passed for every workflow
• clean PyInstaller and Inno Setup builds passed
• packaged Settings and Diagnostics windows were visually verified
• release smoke and detached SHA256 verification passed
• Microsoft Defender custom scan passed
• desktop and mobile website/wiki checks passed without broken images, overflow, or console errors

Release note

This PR does not create or publish a release. After review and merge, the v5 draft must be created manually from master with the Build Draft Release workflow and reviewed using docs/release-checklist.md.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.