chore(release): prepare v0.1.1 candidate

[tcballard]

Summary

Implements the release preparation phase of Issues #24 and #29.

Adds:

• the shared 0.1.1 (3) identity for both signed macOS channels;
• local-authority Developer ID signing and notarization with no private keys in GitHub;
• a fail-closed command that verifies the final ZIP before creating a draft release;
• downstream GitHub verification of the exact published artifact before Homebrew updates;
• release notes and channel status for the first unified candidate.

Scope

Included

• Set MARKETING_VERSION to 0.1.1 and CURRENT_PROJECT_VERSION to 3.
• Keep signing certificates and notarization credentials on the maintainer's Mac.
• Create only a draft GitHub release from the locally notarized, stapled, extracted-and-reverified ZIP.
• Trigger GitHub automation only after the owner publishes that draft.
• Download and verify the published ZIP's identity, signatures, ticket, Gatekeeper status, entitlements, version, build, and extension contract before updating Homebrew.
• Preserve the existing v0.1.0 GitHub artifact and App Store build 0.1.0 (2) as historical artifacts until replacements are accepted.

Excluded

• Creating or publishing the v0.1.1 release in this PR.
• Uploading the Apple Distribution package to App Store Connect.
• Submitting the app for App Review.
• Storing a Developer ID certificate, private key, or notarization credential in GitHub.

Product / Architecture Decisions

• Use the maintainer Mac as the only signing authority.
• Use 0.1.1 (3) rather than replacing the existing experimental v0.1.0 tag.
• Keep one version/build/source contract while retaining the Store sandbox and local-only provider policy.
• Treat locally generated branch artifacts as readiness evidence only; release artifacts must be rebuilt from merged origin/main.
• Separate draft creation from publication so final release remains owner-controlled.
• Keep GitHub downstream-only: verify the immutable published asset and update Homebrew using the already-configured tap token.

User-Facing Contract

CLI

After merge, from the exact clean origin/main commit:

./script/release_candidate.sh 0.1.1 3
./script/create_release_draft.sh
./script/create_release_draft.sh --create

The first command builds and verifies both channels. The second is a read-only draft preflight. The third creates an unpublished GitHub draft for owner review.

Human Output

• Reports artifact identity and checksum.
• Rejects dirty, non-main, unsigned, improperly signed, unstapled, or version-mismatched inputs.
• README identifies v0.1.1 (3) as prepared but not published.

JSON Output

• No JSON contract changes.

Exit Codes

• 0: requested release check or draft creation succeeded.
• non-zero: source provenance, identity, signature, notarization ticket, Gatekeeper, entitlement, or GitHub operation failed.

Verification

Ran

./script/release_identity.sh --verify 0.1.1 3
swift test
./script/preflight_app_store.sh
BUILD_CONFIGURATION=Release SORTING_HAT_SIGN_IDENTITY="Developer ID Application: Thomas Ballard (R8HXTBY3NM)" ./script/build_and_run.sh package
SORTING_HAT_APP_STORE_OUTPUT=/private/tmp/SortingHat-011-Release/AppStore ./script/archive_app_store.sh
bash -n script/verify_release_archive.sh script/create_release_draft.sh script/release_local.sh script/release_candidate.sh
./script/generate_xcode_project.sh
git diff --check

Covered

• 74 Swift tests passed.
• The old 0.1.0 (2) identity was rejected by the release contract.
• The Store structural preflight passed at 0.1.1 (3).
• The app and nested Finder Action passed Developer ID signature verification at 0.1.1 (3).
• Xcode exported an Apple Distribution package whose app and extension summary passed at 0.1.1 (3).
• An intentionally unstapled ZIP was rejected by the shared archive verifier.
• Draft creation rejected a dirty worktree and a commit that was not exact origin/main.
• No artifact was notarized, uploaded, submitted, or published.

Review Path

Review Configuration/Release.xcconfig, script/verify_release_archive.sh, script/create_release_draft.sh, .github/workflows/release.yml, script/release_local.sh, then the release notes and distribution documentation.

Notes For Reviewer

• GitHub requires only the existing HOMEBREW_TAP_TOKEN for this release path.
• The published-release workflow no longer builds, signs, notarizes, or replaces application artifacts.
• A full candidate will be produced only after this PR is merged, from the exact merged commit.
• Do not merge credentials or generated release artifacts into the repository.