Add encrypted Expedition Pack CI workflows

[Redth]

MAUI release automation currently requires CI-specific setup for toolchains, signing assets, builds, and store uploads. This adds portable, password-protected Expedition Packs so the same reviewed release configuration can move safely between MAUI Sherpa and trusted CI runners.

What changed

• Adds desktop authoring and export for Expedition Packs backed by existing publish profiles.
• Adds maui-sherpa pack commands for validation, dependency/signing setup, cross-platform builds, artifact discovery, and deployment.
• Supports TestFlight, Google Play, Firebase App Distribution, and Amazon's official App Submission API.
• Uses compact JSON, Brotli-before-encryption, AES-256-GCM, and an authenticated binary envelope; v1 packs remain readable.
• Supports GitHub's 48 KB secret limit through Base64URL text encoding, pack split, and validated SHERPA_PACK_1..N reassembly via --from-env.
• Packages and publishes the self-contained MauiSherpa.Cli .NET tool and documents GitHub Actions/Azure DevOps usage.

Compatibility and review notes

• maui-sherpa bundle and SHERPA_BUNDLE_PASSWORD remain supported as compatibility aliases; the primary interface is now pack and SHERPA_PACK_PASSWORD.
• Apple signing material is scoped to disposable temporary keychains and provisioning-profile copies; staged secrets and process output are permission-restricted and redacted.
• The recommended large-secret workflow remains committing the encrypted .sherpapack and storing only its password as a CI secret. Split secrets are available for repositories that require the pack itself to live in secret storage.

Validation

• 82 Expedition Pack engine tests
• 13 CLI workflow tests
• Targeted Core persistence/export and backup-compatibility tests
• Self-contained NuGet package inspection confirms embedded bundle/workload assemblies and documentation

Fixes: #168