Prepare HRA v0.1.15 forward recovery

[0thernet]

Summary

• prepare the self-managed HRA v0.1.15 macOS release candidate and deterministic release contract
• add bounded B14 to B15 installation forward recovery with exact custody continuity and rollback evidence
• replace ambient signing identity discovery with one isolated, nonextractable Keychain signer and strict package verification
• harden native renderer, gateway, Keychain, resident-custody, and installation-handoff boundaries

Verification

• bun run check:complete
• bun run --cwd apps/desktop test:macos
• bun run --cwd apps/desktop package:macos:structural
• bun run check:release-source
• bun run verify:remote-release
• focused release download, remote history, and public-boundary regressions
• credential-free canonical Git proof for all annotated tags and peeled commits
• exact GitHub Actions REST reads authenticated only by the job's automatic contents: read installation token
• live production-signing preflight against the isolated v2 release Keychain

The candidate is one commit and one parent after Q14 (ceb647f7a4a68546fc68ce5e70e770b73c8863eb). The remote has no v0.1.15 tag or release collision.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hra-v0	Ready	Preview	Aug 24, 2026 1:46am

[0thernet]

Superseded by #48. PR #47 passed 3,296 tests and exposed one deterministic 22-seam filesystem matrix crossing Bun's default five-second ceiling by 35 ms under full-suite contention; #48 gives only that test a reviewed ten-second bound without changing assertions or product code.