Offline installer for a self-signed Windows package

The packager this was mined from emits, for Windows, three things: the package itself, a small executable wrapper, and an app-installer manifest. The last two are online artifacts: each fetches URLs under the site base URL you configured, typically a "latest release" path. Before that release exists — every pre-release build, every artifact downloaded from a CI run — those URLs return 404 and both fail. The raw package alone cannot be double-clicked either, because the machine does not trust the self-signed certificate that produced it.

What users can install is a zip of three files:

<App>-Windows-installer.zip
├── install.bat          elevate to administrator → import cert → sideload package
├── app.crt              the self-signed code-signing certificate
└── app-<version>.x64.msix

CI assembles it from the packager's output directory: