Replace munki-pkg with SwiftPkg for installer packaging

[erikng]

Replace the munki-pkg dependency in Nudge's packaging workflow with the SwiftPkg CLI.

build_nudge.zsh currently downloads munki/munki-pkg at commit 71c57fcfdf43692adcd41fa7305be08f66bae3e5 and invokes it through Python to build five installer packages. Upstream has announced the retirement of munkipkg and recommends SwiftPkg. SwiftPkg supports the existing package-project layout and build-info formats, but compatibility with Nudge's actual artifacts needs validation before switching.

Scope

• Select a published stable SwiftPkg CLI release and pin the version and artifact checksum (and action commit if using its GitHub Action). Verify the chosen release's actual assets and supported CLI options rather than relying on development-branch examples.
• Replace the munki-pkg download/extraction setup and all five Python/munkipkg invocations in build_nudge.zsh.
• Remove obsolete munki-pkg variables, temporary archive handling, and the Python dependency specifically used for packaging. Keep unrelated Python simulation tooling.
• Update automatic and manual release/prerelease workflows and the signed PR workflow where dependency installation is needed. Keep local builds supported.
• Preserve package names, identifiers, versioning, install locations, payload contents, ownership/modes, postinstall scripts, distribution behavior, and bundle-relocation settings for Nudge, LaunchAgent, Logger, Essentials, and Suite packages.
• Preserve Developer ID signing and the existing notarization/stapling flow unless a change is required and validated. Propagate nonzero build/signing failures immediately.
• Document the new build dependency and migration in the changelog. The SwiftPkg CLI's build-host requirements must not raise Nudge's macOS 12 deployment target or the resulting packages' intended client compatibility.

Acceptance criteria

• No active packaging step downloads or invokes munki-pkg.
• SwiftPkg is reproducibly provisioned on the macOS GitHub runner and documented for local builds.
• All five packages build successfully; expanded payloads, receipts/identifiers, versions, install locations, permissions, and installer scripts match the existing output's intended behavior.
• Signed packages pass signature verification, notarization, and stapler validation using the existing certificate-import configuration.
• Installation/upgrade checks on disposable test machines confirm the application and LaunchAgent/Logger behavior, including a macOS 12 client compatibility check.
• An isolated package-build failure produces a failed workflow instead of allowing release publication to continue.
• A prerelease packaging run produces all expected artifacts with validation results recorded before using SwiftPkg for a stable release.

This ticket covers the packaging migration only; it does not require adopting the Swiftpkgr desktop app or changing Nudge's runtime/update policy.