release

# Release A production release is a `vX.Y.Z` tag on a `main` commit whose lockstep crate version is exactly `X.Y.Z`. `release.yml` builds the signed, notarized macOS DMG with its one-item Sparkle appcast and the Windows x64 installer with its minisign signature, then attaches everything to a **draft** release. Publishing the draft is the user's switch: it moves `releases/latest` and the production Sparkle feed. Contract: `docs/arch/arch.md` §14; nightlies are a separate channel handled by the `nightly` skill. An explicit request to `run` authorizes the bump commit, the push, the tag, and editing the draft's notes. Nothing in this skill publishes the draft, deletes a release, or moves an existing tag. Record only observed results. ## Usage `/release [run <version> | notes <version> | check <version>]` — no action means `run`. ## `run <version>` 1. **Preflight — stop on any failure and report it.** - `<version>` must match `^[0-9]+\.[0-9]+\.[0-9]+$` and be greater than the current tag from `gh release list`. - `git fetch origin`; require branch `main`, a clean tree, and `git rev-parse main origin/main` equal. Everything meant for the release is already merged. - CI on `origin/main` is green: `gh run list --branch main --workflow ci.yaml --limit 1 --json conclusion`. - No release run is in flight: `gh run list --workflow release.yml --limit 3 --json status`. 2. **Bump.** Set `[package].version` to `<version>` in `crates/runner-app/Cargo.toml`, `crates/runner-ba...