fix: verify self-signed macOS releases after signing

[rianjs]

Closes #19

The hosted dry-run imported the self-signed certificate successfully, but security find-identity excludes untrusted self-signed identities. Remove that false precheck while retaining the exact configured leaf guard and the stronger post-sign strict/designated-requirement verification.

Checks:

• node scripts/check-release.mjs
• node scripts/check-docs.mjs
• git diff --check

[rianjs]

Test coverage assessment — Retune PR #23

Blocker

None.

Major

• Missing hosted dry-run evidence for the corrected path. The PR's only run on head is CI 31528283217; its macOS job builds the native bundle but does not run Configure stable macOS signing, Stable-sign macOS app, Verify macOS app signature, or the aggregate release artifact. node scripts/check-release.mjs only reads workflow text. That leaves the ticket's required proof untested: that the imported self-signed key now signs successfully and that the post-sign strict/designated-requirement checks pass before aggregation. Run workflow_dispatch on 3bf7ffa3b3634ecc5b14dab56d57ec9913bf1185 and inspect its aggregate artifact. The earlier dry-run 31526967230 failed before signing at Require stable macOS signing, so it cannot supply this evidence. Relevant workflow path: .github/workflows/release.yml:137-208.

• The release-contract check would pass if the exact post-sign verification were made ineffective. scripts/check-release.mjs:59-64 merely finds the leaf, identifier, and codesign --verify --deep --strict strings anywhere in the workflow. Those strings also occur in the signing command, so the check would still pass if the verification loop in .github/workflows/release.yml:176-204 no longer inspected both the executable and app, accepted a mismatched requirement, or stopped rejecting cdhash. Scope the assertions to Verify macOS app signature (or rely on the required hosted dry-run) and require its strict verification, extracted designated requirement, identifier-plus-leaf failure branch, and cdhash failure branch.

Minor

None.

Nit

None.

[rianjs-bot]

Automated PR Review

Reviewed commit: 03b23d2616c0
Profile: codex-rianjs-bot - Posting as: rianjs-bot[bot]

Summary

Reviewer	Findings
automation:ci-release	0
policies:conventions	0

Reviewer Coverage

• automation:ci-release — complete (broad); skipped: none; constraints: none
• policies:conventions — complete (broad); skipped: none; constraints: Shared Open CLI Collective source-of-truth documentation was not available locally; review used repository-local guidance and the changed workflow/checker.

Inspected files (2)

• .github/workflows/release.yml
• scripts/check-release.mjs

0 PR discussion threads considered. 0 summarized; 0 resolved.

---

Completed in 59s | gpt-5.6-terra | cr 0.10.284

Field	Value
Model	gpt-5.6-terra
Reviewers	automation:ci-release, policies:conventions
Engine	codex_cli · gpt-5.6-terra
Reviewed by	cr · rianjs-bot[bot]
Duration	59s wall · 1m 18s compute
Cost	unavailable
Tokens	209.6k in / 3.0k out

Per-workstream usage

• orchestrator-selection — gpt-5.6-terra
  • In: 16.5k
  • Out: 195
  • Cache read: 11.0k
  • Cache create: unavailable
  • Cost: unavailable
  • Duration: 7s
• automation:ci-release — gpt-5.6-terra
  • In: 80.5k
  • Out: 1.4k
  • Cache read: 57.6k
  • Cache create: unavailable
  • Cost: unavailable
  • Duration: 32s
• policies:conventions — gpt-5.6-terra
  • In: 78.4k
  • Out: 1.1k
  • Cache read: 50.4k
  • Cache create: unavailable
  • Cost: unavailable
  • Duration: 33s
• orchestrator-rollup — gpt-5.6-terra
  • In: 34.2k
  • Out: 234
  • Cache read: 27.1k
  • Cache create: unavailable
  • Cost: unavailable
  • Duration: 4s