ci(release): isolate signing secrets from publishing permissions

[trsdn]

Context

The release flow now correctly creates a draft, smoke-tests it, and publishes only after success. The remaining privilege boundary is broad: the build/sign/notarize job has contents: write, repository-level Apple secrets, and a checkout that persists the GitHub credential.

Proposed change

• Create a GitHub release environment restricted to v* tags.
• Move MACOS_CERTIFICATE, MACOS_CERTIFICATE_PWD, APPLE_ID, APPLE_TEAM_ID, and APPLE_APP_PASSWORD from repository secrets to that environment.
• Give the build/sign/notarize job only contents: read and set persist-credentials: false on checkout.
• Pass verified artifacts to a separate job that alone has contents: write and creates or updates the draft release.
• Keep the smoke-test and publish jobs separate; do not expose Apple credentials to either.
• Add explicit job timeouts and pin the release runner image deliberately rather than relying indefinitely on macos-latest.

Acceptance criteria

• Signing and notarization still complete successfully for a test release tag.
• Only the jobs that manipulate GitHub Releases receive contents: write.
• Apple credentials are available only through the release environment.
• Checkout credentials are not persisted in the signing job.
• A failed smoke test leaves an unpublished draft.
• The update DMG remains unattested and no AppUpdater attestation policy is introduced.

Maintainer setting required

Create and configure the release environment and migrate the five existing repository secrets.

[trsdn]

Code and repository setup are complete via merged PR #71. The release environment exists and is restricted to v* tags; signing is read-only, artifacts are verified across jobs, only draft creation/publication have release-write access, smoke testing is read-only, tags are bound to the triggering SHA, and the exact five-asset contract is enforced.

Remaining external step: re-enter MACOS_CERTIFICATE, MACOS_CERTIFICATE_PWD, APPLE_ID, APPLE_TEAM_ID, and APPLE_APP_PASSWORD as release environment secrets, run a tagged release successfully, then remove the repository-level copies. GitHub intentionally does not expose existing secret values, so they cannot be copied automatically. Keeping this issue open for that credential-owner action.

[trsdn]

Correction: my previous conclusion was wrong. OpenWritr is already allowlisted as profile openwritr in trsdn/macos-notarization-broker; Apple credentials belong only in the broker’s protected macos-signing environment, never in this repository or an OpenWritr environment. The direct signing workflow and this issue’s secret-migration acceptance criteria therefore describe the wrong target architecture. I am replacing that path with the broker contract, preserving the AppUpdater alias, smoke test, immutable tag checks, and the explicit rule that the update DMG must not be attested. Repository-level Apple secrets will be removed after the broker-backed path is merged and validated.

[trsdn]

Final completion evidence after merge:

• Broker PR trsdn/macos-notarization-broker#69 merged at d0077d5.
• OpenWritr PR fix(release): use notarization broker #110 merged at bf94265.
• MACOS_CERTIFICATE, MACOS_CERTIFICATE_PWD, APPLE_ID, APPLE_TEAM_ID, and APPLE_APP_PASSWORD were deleted from OpenWritr repository secrets.
• The OpenWritr release environment contains no secrets.
• COPILOT_GITHUB_TOKEN remains untouched.
• .github/workflows/release.yml and direct notarization/credential setup scripts are removed; authenticated broker verification and smoke-before-publish are on main.
• Neither DMG is attested; the ZIP remains the only provenance-eligible release artifact.