Scope signing secrets to the signing step; fix main lint

[carthworks]

Follow-up to #7, which was merged before these two fixes landed.

Release workflow: signing secrets now reach only the step that signs
The "Configure code signing" step wrote CSC_LINK and CSC_KEY_PASSWORD to $GITHUB_ENV. Every later step in the job could then read them, including the packaged-app end-to-end test. This was flagged by ECC Tools as "[high] Environment variable with secret exposed".

They are now passed only through the env: of "Build, sign and publish installer". A separate step that sees no secrets still prints the "unsigned installer" warning when WIN_CSC_LINK is not set.

CI on main: lint
The latest commits on main (CookieConsent.jsx, TrustCenter.jsx) left six unused icon imports, and eslint fails on them. They are removed here; eslint, ruff and vite build all pass locally.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Jze3nDgZGqUXGceiu5RCAf

---

Generated by Claude Code

[ecc-tools]

ECC Tools / Security Evidence

Commit: c0e291e2abc7f515745a850c560ce2856b650dcb

Security evidence gate passed (success)

No security-sensitive scanner-evidence gap detected.

Mode: enforce

Scanned 3 changed file(s). No missing scanner-evidence signal was detected.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[ecc-tools]

ECC Tools / PR Risk Taxonomy

Commit: c0e291e2abc7f515745a850c560ce2856b650dcb

PR taxonomy review recommended (neutral)

Detected 2 PR taxonomy bucket(s): Security Evidence, CI/CD Recommendation.

Scanned 3 changed file(s).

Roadmap taxonomy buckets:

Security Evidence

Security-sensitive changes should carry explicit scanner, code-scanning, or focused regression evidence.

Signals:

• 1 security-sensitive path(s) changed

Paths:

• .github/workflows/release.yml

CI/CD Recommendation

CI, dependency, coverage, and contract signals should be routed into follow-up checks or verification work.

Signals:

• User-facing UI changes may ship without browser coverage
• CI workflow changes may ship without failure-mode evidence
• Dependency or CI drift could surface after merge
• 1 CI or workflow path(s) changed

Paths:

• .github/workflows/release.yml
• src/components/CookieConsent.jsx
• src/pages/TrustCenter.jsx

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[ecc-tools]

ECC Tools / Reference Set Readiness

Commit: c0e291e2abc7f515745a850c560ce2856b650dcb

Reference set readiness gaps detected (neutral)

Reference evidence present for 0/7 areas (0%) across 3 changed file(s).

This check is based on files changed in this PR. Repository-level readiness is still reported by /ecc-tools analyze comments and generated manifests.

Area	Status	Evidence / Next Step
Deep analyzer corpus	Missing	Add analyzer fixture, golden, benchmark, or reference-set files that can catch analyzer regressions.
RAG/evaluator comparison	Missing	Add retrieval or evaluator reference-set comparison fixtures with expected ranking behavior.
PR salvage/review corpus	Missing	Add stale-PR, review-thread, reopen-flow, or salvage reference cases for queue cleanup automation.
Discussion triage corpus	Missing	Add public discussion triage fixtures, golden cases, or reference sets for informational, answered, and no-response classifications.
Harness compatibility	Missing	Add cross-harness, adapter-compliance, or harness-audit evidence for Claude, Codex, OpenCode, Zed, dmux, and agent surfaces.
Security evidence	Missing	Attach security evidence such as SBOMs, SARIF, audit reports, or AgentShield evidence packs.
CI failure-mode evidence	Missing	Add captured CI failure logs, dry-run fixtures, or troubleshooting docs for common workflow failure modes.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[ecc-tools]

ECC Tools / Hosted Promotion Readiness

Commit: c0e291e2abc7f515745a850c560ce2856b650dcb

Hosted promotion readiness passed (success)

No hosted promotion evidence gaps detected across 3 changed file(s); 0 corpus scenarios had matching evidence.

This check compares PR file changes against the evaluator/RAG promotion corpus in src/analyzers/fixtures/evaluator-rag-corpus.ts.
Hosted output scoring inspected 0 completed cached hosted job results.

No evaluator corpus scenarios matched this PR.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[ecc-tools]

ECC Tools / PR Config Audit

Commit: c0e291e2abc7f515745a850c560ce2856b650dcb

No changed-config issues detected (success)

Scanned 1 config file(s) present at this commit across 1 changed config path(s) and found no issues in the supported security rules.

Changed config files:

• .github/workflows/release.yml

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[ecc-tools]

ECC Tools / PR Harness Audit

Commit: c0e291e2abc7f515745a850c560ce2856b650dcb

No harness issues detected (success)

Scanned 1 changed config file(s) and found no harness issues.

Changed config files:

• .github/workflows/release.yml

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.