Harden update, credential, and release trust boundaries

[danielpiva]

Summary

• Remove the mutable, unsigned Codex model catalog fetched from the default branch and use only the catalog bundled at build time.
• Fail closed on core downloads unless GitHub supplies a non-zero size, a valid SHA-256 digest, and the exact expected official release URL.
• Contain the managed core with --local-model, disabled remote control-panel delivery/updates, and a stripped GITSTORE environment variable.
• Replace the runtime 123456 API key with an OS-random 256-bit key, rotate legacy/example keys, retain at least one key, and write managed configuration files with owner-only permissions on Unix.
• Disable automatic application replacement until update manifests are signed by a key rooted in the app; manual release-page updates remain available.
• Add a restrictive Tauri CSP and harden the release workflow with least privilege, immutable action SHAs, disabled runtime caching, concurrency controls, and shell-safe environment inputs.
• Update vulnerable transitive dependencies (event-listener, nanoid, and postcss).

Security notes

The core asset check now binds installation to GitHub's release metadata and exact official paths. This detects missing, corrupt, or mismatched assets, but it is still maintainer-controlled metadata rather than independent code signing.

Existing installations that still use the legacy 123456 API key will rotate it on startup. Managed clients may need their configuration reapplied so they receive the new key.

Validation

• cargo fmt --manifest-path src-tauri/Cargo.toml -- --check
• cargo test --manifest-path src-tauri/Cargo.toml — 201 passed
• cargo clippy --manifest-path src-tauri/Cargo.toml --all-targets -- -D warnings
• bun run check
• bun test — 115 passed
• bun run build
• bun audit --production — no vulnerabilities
• cargo audit --file src-tauri/Cargo.lock — no vulnerabilities; 18 allowed transitive warnings remain (primarily Tauri's GTK3 stack, plus the existing glib iterator advisory)
• zizmor --strict-collection --offline .github — clean
• tauri build --no-bundle — optimized application built successfully on macOS

This is intentionally a draft because the update and credential changes alter security-sensitive behavior across all supported platforms.