[Fazorath]

Closes #120

What

• scripts/sandbox_app_build.py: PyInstaller one-folder build, zipped (.app on Apple Silicon, windowed .exe on Windows x64). Holds Python, the Node package, the built dashboard, regions/ and both Regions' published Cache Packs. Nothing else of the checkout goes in.
• scripts/sandbox_app_smoke.py: starts the zipped app with the browser stubbed and checks no .env is inside, both packs are, /api/state reports a sandbox, the Sandbox has Sensors, a Region switch works on the bundled pack (no download), Stop ends the process, and the temp folder is gone.
• .github/workflows/sandbox-app.yml: build + smoke on macOS-14 and Windows-2022 for PRs touching the packaging; manual dispatch with a number also publishes sandbox-app-v<N> (not latest, from main only). scripts/check.sh is untouched.
• Release notes with the SmartScreen and Gatekeeper steps (no terminal): scripts/sandbox-app-release-notes.md.

Call worth a look: Nepal pack v2

The smoke check found that the bundled Nepal pack (Release cache-pack-nepal-v1) predates hub_site, so switching to Nepal returned a 500. This also hits a checkout with no local pack. I rebuilt it from the current regions/nepal/region.json (scripts/build-cache-pack.sh nepal), published cache-pack-nepal-v2 (not latest) and bumped RELEASED_PACKS.

Tested

• scripts/check.sh: all pass.
• Real PyInstaller build and the full smoke sequence on Linux (a local dry run with the unzip step swapped): passed.
• Not yet run: the macOS and Windows legs. This PR's CI is their first run.
• Unproven: a person double-clicking each download on real Windows and macOS, past SmartScreen and Gatekeeper, until someone reports it.

After merge

Dispatch the workflow with version 1 to publish sandbox-app-v1; the ticket isn't finished until it exists. Security review requested (public binary download).

code-review reviewed this repo (StormShields/Stormshield) against origin/main.