Launch gate: code-signing certs, then the first signed release

[adbarc92]

Release tagging is deliberately deferred, decided 2026-08-09 — recorded here so it stops resurfacing as an audit finding, and so the reasoning is discoverable.

Current state

• release.yml fires on any v* tag and publishes a public GitHub Release with bundles attached.
• The only repo secret configured is EMBARGO_GUARD_CONFIG. None of the seven signing secrets exist: APPLE_CERTIFICATE, APPLE_CERTIFICATE_PASSWORD, APPLE_ID, APPLE_PASSWORD, APPLE_TEAM_ID, WINDOWS_CERTIFICATE, WINDOWS_CERTIFICATE_PASSWORD (plus TAURI_SIGNING_PRIVATE_KEY / ..._PASSWORD for the updater).
• Tauri degrades gracefully, so a tag today would publish unsigned installers — SmartScreen friction on Windows, Gatekeeper block on macOS.
• No releases exist. Versions read 0.1.0 across Cargo.toml / tauri.conf.json / cockpit/ui/package.json (the last aligned from 0.0.0 in docs(status): refresh after the 2026-08-09 work-audit pass #50).

The actual blocking work (out-of-repo, costs money)

• Windows OV/EV code-signing certificate (~$100–400/yr)
• Apple Developer Program membership ($99/yr) for notarization

Then

1. Add the secrets above
2. Tag v0.1.0
3. Verify release.yml produces signed + notarized bundles on all three OSes
4. Consider a CHANGELOG — none exists

The first public release should be a signed one.