chore: signed appcast, a release script that refuses inconsistency, pinned CI

[LucaGerlich]

Release hardening from the post-launch audit, to merge before 1.1.0 is cut.

Signed appcast (M2)

The appcast is served from main. Only the update archive was EdDSA-signed, so anyone with push access — or a stolen token — could change the release notes or put a link in the update dialog. 1.1.0 sets SUVerifyUpdateBeforeExtraction and SURequireSignedFeed (Sparkle 2.9): it accepts only an appcast signed with the release key. generate_appcast signs the feed automatically once a build requires it; the signature is an XML comment, so 1.0.x clients keep working. From now on appcast.xml must never be edited by hand (now in CONTRIBUTING).

Scripts/release.sh

• Preflight before any build: on main and equal to origin/main; no existing tag, GitHub release or dist/<version>/; the exact Developer ID identity; SUPublicEDKey set (now fatal); Sparkle tools resolved from the pinned 2.9.6 via -clonedSourcePackagesDirPath (the old DerivedData glob ran whichever version it found first).
• Unit tests run before archiving.
• Each release lives in dist/<version>/ — the old rm -rf dist also deleted the previous dSYMs and dropped earlier appcast items (1.0.0 was already gone).
• The appcast is generated from a copy of the published one, so old items keep their URLs; no deltas.
• Fatal verification: sign_update --verify appcast.xml, and the DMG against its edSignature — generate_appcast only warns and writes an unsigned feed if it cannot sign.
• Asserts the exported app's team, signs the DMG with the full identity and a stable identifier.

CI

macos-26 + Xcode 26.6 (the release toolchain) instead of macos-latest + newest Xcode; actions/checkout pinned to the v7.0.1 SHA; read-only token, concurrency group, 30 min timeout.

Also

• Drops the unused user-selected-files entitlement; ignores .claude/settings.local.json.
• Adds docs/post-launch-audit.md with its resolution status.

Test plan

• bash -n passes; the guards stop a dirty tree and a non-main branch before any work (run locally).
• The signature extractor returns the published 1.0.1 signature and nothing for an unknown version.
• -clonedSourcePackagesDirPath delivers Sparkle 2.9.6's generate_appcast and sign_update.
• Built app carries both Sparkle keys and no user-selected entitlement; unit tests pass.
• CI green on the pinned runner and Xcode.
• Full pipeline: the 1.1.0 release run itself (it ends with the fatal signature checks).