Publish secure macOS update artifacts with a manual Release workflow

[thrr87]

What to build

Add a separate manual GitHub Actions workflow for producing secure macOS update artifacts. The workflow must build one universal app for Apple Silicon and Intel, sign update artifacts with Sparkle EdDSA, and create a Draft GitHub Release. Publishing remains a separate, explicit human action.

The release flow is intended to be started from chat after the user provides a version number. It must not require an Apple Developer ID certificate. The EdDSA private key must be stored only as a protected GitHub Actions secret, with an external backup such as Bitwarden.

Acceptance criteria

• A manually triggered release workflow accepts an explicit stable version and validates that the version and build number are consistent and newer than the previous release.
• The workflow builds a universal macOS app containing both Apple Silicon and Intel executables and verifies both architectures before packaging.
• The app bundle is packaged in an update-safe archive that preserves its required metadata and symlinks.
• The archive and update feed are signed with Sparkle EdDSA, and the private key is available only to the protected release job.
• Secrets are not exposed to pull-request or ordinary push jobs and are not printed in logs.
• The workflow creates a Draft GitHub Release with the app archive, signed stable update feed, version information, and release notes attached or linked.
• The workflow never publishes the release automatically and never marks it as a prerelease.
• Drafts and prereleases are not exposed through the stable update feed; only an explicitly published stable release becomes discoverable by installed apps.
• A validation or dry-run path verifies the artifacts and feed without publishing version 0.2.7.
• The release runbook documents the chat-driven flow, the required explicit publish confirmation, EdDSA key backup, and the recovery limitation if the signing key is lost.

Blocked by

None - can start immediately

[thrr87]

Implemented in #64 (a208d5e).

• Manual Release workflow accepts a stable version, validates version/build progression, builds and verifies a universal arm64 + x86_64 app, signs the archive and appcast with Sparkle EdDSA, and creates only a Draft Release.
• The protected release environment is restricted to main; SPARKLE_PRIVATE_KEY is stored as its environment secret.
• Local dry-run validation passed for version 0.2.7, including the universal archive, strict code-signature check, signed appcast, and critical-update marker.
• The release runbook documents the chat-driven flow and explicit publish step.

No 0.2.7 release, tag, or draft was created. The issue can close when #64 merges.