M7-lite: Unsigned pilot packaging + PILOT.md

[sepehrsadri]

Tracking issue for M7-lite (docs/ROADMAP.md "Now: the 0.0 pilot"). Needs M5.

Signing is deliberately skipped for the 0.0 pilot (no Apple Developer ID enrollment yet)
— see the justfile's release-signed stub and PILOT.md's Gatekeeper walkthrough for the
tradeoff this accepts.

Scope

• just release-unsigned: tauri build → assert an ad-hoc signature is present (Apple
  Silicon won't launch without at least one) → zip → print the SHA-256.
• just release-signed: written now as a clear stub, so switching to notarization later
  is a flag flip, not a rewrite.
• Tag v0.0.1, GitHub pre-release, .zip attached, SHA-256 in the release notes.
• PILOT.md:
  • The Sequoia first-open walkthrough (Gatekeeper removed the Control-click→Open bypass),
    screenshotted, framed honestly: "macOS will say it can't verify this app. That's
    because I haven't paid Apple $99 yet, not because something is wrong." Terminal
    fallback (xattr -dr com.apple.quarantine /Applications/Wit.app) as a last resort.
  • What Wit does and does not do; what leaves the Mac (nothing).
  • The criterion-4 measurement protocol: a designated hands-off week — no nudges,
    digests suppressed, timestamped counter events so the 7-day window is auditable. State
    in the open that "compare opened in the app" amends ROADMAP's "run wit diff"
    rather than quietly redefining it.
• Opt-in usage report (counts and shapes only, previewed verbatim, copy-to-clipboard).

Exit criteria

• A clean Mac installs from the release link following PILOT.md alone.
• The kit (release link + PILOT.md) goes to friend Verify a Wit-produced .als actually opens in Ableton Live #1.
• The actual experiment: 5 friends × 2 unprompted compares in a hands-off week. A
  clean negative is an acceptable outcome — it redirects investment to Logic payload
  schemas (issue Map Logic ProjectData chunk payloads (starts with AuRg or Trak) #3) before more product gets built.