ci: formalize release qualification lifecycle

[FernandoAbishai]

Summary

• add a durable release QA lifecycle matrix separating source/PR, candidate, public dry-run, clean artifact, manual qualification, publish, and post-publish ownership
• add deterministic model-manager smoke coverage to normal PR CI
• make the no-argument release metadata smoke source-safe with a temporary deterministic fixture; candidate runs still validate the real packaged metadata directory via --dir
• strengthen release workflow structure checks for job dependencies, native clean-runner verification, bounded exact-DMG identity/backend proof, and no clean-runner real-model duplication
• run the bounded packaged identity/backend checks against ScriptCut.app mounted from the exact public DMG

Scope

• preserves .github/workflows/release-unsigned.yml as the only public release authority
• preserves build-once, exact-byte staging, attestations, clean native verification, current-main, confirmation, real-model, checksum, DMG, and ad-hoc signing gates
• no product/runtime/transcription/signing-strategy changes
• no tag or GitHub Release was created

Validation

Final PR head: 3cb1cd6165a5e96005ceb0d1b623ddeff44aad95

Normal PR CI passed:

• run: https://github.com/FernandoAbishai/ScriptCut/actions/runs/31750973540
• npm run smoke:release-identity
• npm run smoke:release-metadata
• npm run smoke:public-release
• npm run smoke:release-workflow
• npm run smoke:runtime-contract
• npm run smoke:renderer-policy
• npm run smoke:model-manager
• frontend lint/build
• backend smoke
• Python compileall

Final hosted public dry-run passed:

• run: https://github.com/FernandoAbishai/ScriptCut/actions/runs/31751105075
• inputs: release_tag=v0.1.0-alpha.4, publish=false, real_model=true, empty confirmation
• build and attest: passed in 9m40s
• clean native arm64 verification: passed in 1m30s
• exact DMG artifact: 370975228 bytes, SHA-256 0873d3a680ca11d9cd09272b9fdfe55a9ed355d29989544b0accea1aaa6edd5c
• mounted exact-DMG identity: app.getVersion=0.1.0, CFBundleIdentifier=com.fernandoabishai.scriptcut
• mounted exact-DMG backend: /health: 200, Finder-like PATH, bundled Python, no system Python dependency
• Gatekeeper diagnostic: exit 3, expected for the unsigned alpha and not treated as trust
• publish job: skipped

Local native candidate reached the existing iconutil gate but macOS 15.7.7 rejected the canonical iconset; hosted macos-14-arm64 validation passed the authoritative candidate and public artifact path.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.