fix: fail closed on untrusted native releases

[abrichr]

Summary

• require the native tag tree to equal the deterministic five-file version transform from the matching engine tag
• replace direct writes to main with a protected version-sync pull request; the post-merge job only creates the immutable desktop-vX.Y.Z tag
• reject a native version pull request unless it starts at current main, strictly advances the version, and contains only the exact five-file transform
• reject the native tag at promotion time if it does not advance every published native release
• bind each native build to the exact stable engine tag, commit, GitHub release ID, and release URL
• define a closed engine-release receipt that requires the exact protected-main release workflow commit, released source commit, wheel hash, and sdist hash
• bind native provenance to the exact GitHub-hosted workflow, native tag commit, run ID, and run attempt
• define a closed, strictly monotonic stable channel descriptor that binds the selected index and SHA256SUMS by SHA-256
• authenticate the stable descriptor, selected index, and SHA256SUMS against their exact GitHub workflow certificate identities before installer verification
• verify the complete descriptor-to-index-to-checksum-to-asset chain and detect local file replacement during attestation verification
• retain optional prior-channel and minimum-version checks for consumer rollback protection
• require the configured Apple Developer ID identity and Team ID on the DMG and installed app
• require valid timestamped Authenticode on each Windows installer, installed executable, and NSIS uninstaller

Approval-held target-state work

This pull request remains a draft. It does not yet move native build, signing,
publication, mirror, or channel-pointer mutation into a protected-main
workflow_dispatch transaction. The existing tag and release-event workflow
must not publish a release. The privileged workflow rewrite needs explicit
founder approval after its write-authority and publication risk is reviewed.

The Desktop Cloud Connector replacement and its shared qualification-v2
terminal admission are also approval-held in draft PR #116. No release can
occur until Desktop consumes the frozen shared verifier and accepts only an
exact signed VERIFIED result that binds the permit, run sequence, policy,
identity, and effect proof.

Runtime dependency state

This branch updates the frozen runtime from Flow 1.27.1 and Types 0.7.0 to the published Flow 1.31.0 and Types 0.10.0 set. Flow 1.31.0 includes the qualified-bundle sanitization fix from Flow commit faf9945537d4011baeb36ce5f063b6e1814903e6 and PR OpenAdaptAI/openadapt-flow#351.

This is an interim exact pin. It is not the final hosted-operation release pin. Do not release the native application until the later immutable Flow release supplies the complete authorization and typed push-result contract, Cloud deploys and accepts that exact runtime, and Desktop updates its pin and lock from that accepted evidence.

External activation required

The workflow is not the complete trust boundary. Before the next native tag or release:

1. Add a no-bypass pull-request ruleset for main. Require exact-head checks and require branches to be up to date before merge.
2. Require the Reject a stale native version pull request check for native-version/v* pull requests.
3. Add an immutable tag ruleset for v*. Only the engine release identity can create a tag. Do not permit update or deletion.
4. Add an immutable tag ruleset for desktop-v*. Only the native freshness identity can create a tag. Do not permit update or deletion.
5. Configure all six Apple secrets in the reviewed native-release environment:
   • APPLE_CERTIFICATE
   • APPLE_CERTIFICATE_PASSWORD
   • APPLE_SIGNING_IDENTITY
   • APPLE_ID
   • APPLE_PASSWORD
   • APPLE_TEAM_ID
6. Configure exactly one Windows method. The recommended Azure Trusted Signing method uses:
   • AZURE_TENANT_ID
   • AZURE_CLIENT_ID
   • AZURE_CLIENT_SECRET
   • TRUSTED_SIGNING_ENDPOINT
   • TRUSTED_SIGNING_ACCOUNT
   • TRUSTED_SIGNING_CERTIFICATE_PROFILE
7. The alternative importable PFX method uses:
   • WINDOWS_CERTIFICATE
   • WINDOWS_CERTIFICATE_PASSWORD
   • WINDOWS_CERTIFICATE_THUMBPRINT

Do not configure both Windows methods. Linux needs no founder-managed key. GitHub gives the pinned release workflow a short-lived OIDC identity.

Exact-head local evidence

Head: 997da51

• Python: 892 passed, 6 skipped
• focused release contract: 65 passed
• Ruff: passed
• Python format check: passed
• Git diff check: passed
• GitHub exact-head CI: all executed checks passed

The full Python suite needed local loopback socket access. Its first sandboxed attempt failed only because the sandbox denied that socket bind. The full rerun with loopback access passed.

Release operation

Keep this PR as a draft. Do not merge it or publish a native release until the approval-held workflow changes, repository rules, signing identities, final Flow pin, Cloud acceptance, and live release verification are complete.

Historical desktop-v0.15.0 assets keep their original ad-hoc or unsigned labels. They do not satisfy this trust contract.