v1.3 #50: credential-free CI and shared artifact verification

[cam11505]

Scope

Refs #50. Development-only subset. Official acceptance for #49 and #50 remains deferred.

• Independent Windows/macOS/Ubuntu source CI; retain Windows portable and installer gates.
• Credential-free macOS app/DMG lane on main after integration.
• Shared strict build-info, manifest/checksum, SPDX/license and source metadata verification.
• Bind Windows actual native bytes and macOS prepared/relocated/ad-hoc signed backend hashes to provenance; re-seal the outer developer bundle after metadata update.
• Preserve native architecture, self-test, Finder, installer and independent DMG checks.
• Reuse only exact controlled QtWebEngine source reference; document official-source delivery limitations.

Verification

Local Ruff/format passed; pytest: 291 passed, 4 skipped. Final PR-head CI runs 36295034442 and 36295034450 succeeded; downloaded macOS app/DMG and Windows evidence independently verified. See final verification comment for commit binding.
Merged with explicit user authorization at e03405c. Post-merge main CI running.

Deferred

No paid Apple enrollment, Developer ID, notarization, staple or official Gatekeeper claim. Physical Mac QA deferred, not passed. #49 and #50 official acceptance remain open; #51 official RC/tag/release blocked. No v1.3 tag/release or Linux package.

[cam11505]

Final development-subset verification passed (2026-09-27).

• PR head: 0ea6233.
• CI tested PR merge commit c8fefe5; its parents are main 492a6f8 and the final PR head above.
• Run 36295034442 success: Windows/macOS/Ubuntu source tests, license audit, Ruff/format, Windows portable self-test, installer install/uninstall/registration checks, source/checksum/release-set verification and artifact upload.
• Run 36295034450 success: app metadata/SPDX/source checks, 223 arm64 Mach-O files, packaged self-test, cold/warm Finder opens, development DMG build and independent remount/install/self-test, artifact upload.
• Downloaded Windows installer verification reports confirm success and c8fefe5 commit.
• Downloaded macOS app independently passed shared metadata/SPDX/source checks. Downloaded DMG independently passed commit/channel/inventory/SHA-256 checks: 59544faf8b9804bb916dd32732784e27b59ec7b7314d9f3537383cbe364cf72b.
• Local: 291 passed, 4 skipped; Ruff and format passed.

Development subset ready for review/merge authorization. No merge or publication performed. Official signing/notarization/staple/Gatekeeper and physical Mac QA remain deferred, not passed; #49 and #50 official acceptance remain open and #51 official RC/tag/release blocked.

[cam11505]

Merged with explicit user authorization at e03405c. Post-merge main verification is complete:

• Run 36295509996 completed/success: independent Windows/macOS/Ubuntu source tests and Windows portable, installer, release-set verification and artifact upload.
• Run 36295509990 completed/success: credential-free macOS arm64 app, Finder, development DMG and independent mounted-app/inventory/self-test verification and artifact upload.
• Both runs tested exactly e03405c.
• Local main and origin/main match the merge commit; Ruff/format passed and pytest 291 passed, 4 skipped.

Authorized #50 credential-free subset is integrated and verified. Formal #49/#50 acceptance remains deferred and OPEN; #51 official RC/tag/release remains blocked. Physical Mac QA is deferred, not passed. No tag or GitHub Release was created. #49's unintended automatic closure was corrected and its negated closing reference removed from the PR description.