docs(release): prepare release process

[paul-cch]

Summary

• Replace the mixed Unreleased changelog with the notable changes made after v1.0.0.
• Add a source-only GitHub Release checklist with explicit version and candidate placeholders.
• Record release gates, exact-head proof, archive verification, abort rules, and clean closeout without creating a versioned section or release object.

Why

The existing Unreleased section still contained entries that were already present when v1.0.0 was tagged. Publishing that boundary later would repeat old work and obscure the actual tag-to-head changes.

WalBridge also had no repository-local release procedure. The new checklist documents the current source distribution model and keeps future release work behind explicit owner authorization.

Validation

• Changelog boundary check against v1.0.0 and the full tag-to-head commit and file diff.
• Release checklist Bash blocks parsed with bash -n.
• Fresh Python 3.11 environment, dependency resolution, and pip check.
• Ruff, Ruby YAML parsing, and actionlint.
• Full Python suite, 73 tests.
• CLI flow suite, 8 tests.
• Repository Bash syntax and ShellCheck command sets.
• Quartz import and display detection on macOS.
• Both Swift tools compiled and completed runtime startup smokes.
• Installer deployed into a temporary home with launchctl replaced by a no-op shim.
• Structured autoreview found no accepted or actionable findings.

Boundary

This PR changes documentation and release metadata only. It does not add a versioned changelog section, change a version source, create a tag or GitHub Release, publish a package, deploy Pages, or change the live host. No external live boundary applies to the changed files.

Privacy Gate: PASS. Public Model Identifier Gate: PASS.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 24b9b653c5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Refresh origin/main before tagging

In this release flow the only fetch happens back in the Prepare section before the CI/dependency/live-host proof, so if another commit lands on main during that interval, this check still compares against the stale local tracking ref and can allow tagging/publishing <CANDIDATE_SHA> after the real remote branch has moved. Refresh the remote state in the create gate, or compare against git ls-remote, before pushing the tag.

Useful? React with 👍 / 👎.

[paul-cch]

Landed as cb29a11889185b777b0028eedc7d2da40142e4f7 from reviewed commit 24b9b653c55f835b1ddea82cce559cbef111a867.

Release-boundary proof:

• Compared CHANGELOG.md with the file at v1.0.0, the full v1.0.0...HEAD commit list, changed-file diff, and merged PRs feat(docs): add GitHub Pages website #1, fix(docs): clean up AI slop in GitHub Pages website #2, refactor(wcsync): centralize Target App writing #4, fix(deps): require secure Pillow release #5, and ci(deps): update GitHub Actions majors #6.
• The Unreleased section now contains only notable post-tag changes. It does not add a dated or versioned release section.
• RELEASING.md uses <VERSION> and <CANDIDATE_SHA> placeholders and documents the source-only GitHub Release process. No tag, release, version bump, package publication, signing step, or deployment was added.

Local validation:

• Fresh Python 3.11 environment resolved Pillow 12.3.0 and PyObjC Quartz 12.2.1; pip check passed.
• Changelog boundary and local release-document reference checks passed.
• Release-document Bash blocks passed bash -n.
• Ruby YAML parsing and actionlint passed.
• Ruff passed.
• Full test suite passed, 73 tests.
• CLI flow suite passed, 8 tests.
• Repository Bash syntax and ShellCheck command sets passed.
• Quartz import and display detection passed on macOS.
• Both Swift tools compiled and passed runtime startup smokes.
• The installer deployed into a temporary home with launchctl replaced by a no-op shim, so no live launchd state changed.

Review and CI:

• Structured autoreview reported no accepted or actionable findings.
• PR CI passed all seven jobs: https://github.com/paul-cch/WalBridge/actions/runs/29436671864
• Exact-head main CI passed all seven jobs: https://github.com/paul-cch/WalBridge/actions/runs/29436835479
• The automatic Pages build passed: https://github.com/paul-cch/WalBridge/actions/runs/29436834387

Live-proof boundary: this PR changes repository documentation and release metadata only. It does not alter product behavior or a live host path, so built, source, installer, and workflow proof is the applicable boundary.

Dependency refresh: Pillow 12.3.0 and PyObjC Quartz 12.2.1 remain the current stable resolutions. The workflow pins the current stable actions/checkout v7 and actions/setup-python v6 commits. The reviewed Pillow advisory set has no newer entry requiring a higher floor.

Privacy Gate: PASS. Public Model Identifier Gate: PASS. The exact diff, PR body, CI logs, proof text, and tracked artifacts contained no blocking private data, identifiers, or unknown generated artifacts. GitHub-hosted runner home paths in CI logs were classified as public runner metadata.