Unify the CI build, package and setup scripts between Audacity, MuseScore and muse_framework

Follow-up to #12135, which covers the scripts that can be shared as they are.

This task covers the rest — the build, package and setup scripts. They are harder for two reasons.

Two languages. Audacity rewrote these as CMake (ci_build.cmake, package.cmake, setup.cmake), while MuseScore and muse_framework still use shell and batch (build.sh, package.sh, build.bat). Sharing them means settling on one form and updating the other side's callers.

Real app-specific content. Unlike the first batch, these carry per-app values: artifact and volume names, update-information URLs, signing and notarization, MSI upgrade GUIDs, architecture matrices and package lists. Each has to become a parameter or stay behind a thin wrapper in the app.

Families:

• linux/{build,package,setup} and linux/tools/make_appimage.sh
• macos/{build,package}
• windows/{build,package,setup}
• the build.artifacts/env/*.env producers (make_*_env)
• translation/s3_packandsend.py
• crashdump symbol generation and upload

Some contracts need agreeing before any of it can move, for example:

• build_mode.env holds devel_build/nightly_build/... in Audacity and devel/nightly/... in the other two, and every consumer branches on those values
• artifact_name.env means the GitHub upload-artifact name in Audacity and the package filename everywhere else
• the build driver: ninja_build.sh in MuseScore and muse_framework, ci_build.cmake in Audacity

Worth noting the direction is not one-way: Audacity is ahead on make_appimage.sh (hermetic tool provisioning through muse_deps, Qt pruning, a larger system-library exclusion list) and on the Windows signing script, so some of these move from Audacity into the framework rather than the other way round.

The S3 helpers need an --acl-public opt-in before they can be shared: it works on extensions.musescore.org but the audacity-updates bucket has ACLs disabled and rejects every upload (audacity/audacity#11799). MuseScore already dropped the flag from release/push_file_to_s3.sh for the same reason while keeping it in tools/s3_push_file.sh.