Publish verified release bundles and store-signed downloads - #181

Release downloads now include versioned browser ZIPs, source, SHA256SUMS, build metadata, installation guidance and the tag's changelog. The publisher copies the exact tested artifacts and rejects conflicting existing files; reruns preserve maintainer notes and the independently managed signed-download section.

A separate workflow collects the matching store-signed Chrome CRX3 and Firefox XPI after publication. It verifies original CI provenance, Chrome developer/Google signatures, Mozilla download hashes, extension identity and package contents. Collection is read-only; a separate publication job adds immutable signed files. Recent releases are revisited every six hours while store approval is pending. Per-tag locks, stale-result rejection and completion receipts written last protect retry/recovery behavior.

Validation:

• pnpm check: 480 unit tests and 95 injection tests passed, plus lint/typecheck.
• Real 5.1 bundle validated against all existing GitHub asset hashes; reviewed source correction preserved.
• Live read-only collection verified the signed Firefox 5.1 XPI and all 152 payload files.
• Genuine Chrome CRX3 cryptographic checks passed; Chrome still serves 5.0, correctly reported as pending rather than attached to 5.1.
• Independent review covered workflow privilege boundaries, archive validation, body preservation and failure recovery.

No runtime version bump or new signing identity. Chrome 5.1 remains in Google's review queue. The existing 5.1 release will be backfilled and the new workflow tested after merge.