Add opt-in tip update channel and rolling publish workflow

[baron]

Summary

Adds an opt-in Tip Builds update channel and a guarded rolling publish lane for latest passing main builds.

App-side:

• adds persisted UpdateChannel support (stable default, tip opt-in)
• delegates Sparkle feed selection at runtime
• accepts official stable/tip feed URLs with the official Sparkle key
• adds Settings UI copy for Stable vs Tip Builds
• makes passive update comparison prefer sparkle:version build numbers
• keys passive-update suppression by build number when present so one dismissed tip does not suppress future same-marketing-version tips

GitHub/release side:

• adds Publish Tip workflow after successful CI on protected main, plus manual dispatch
• stages without secrets, signs/notarizes in tip-release, smokes on a fresh no-secret runner, then publishes with a scoped tip token
• adds Scripts/main_tip_release.sh for stage, sign, and publish-tip
• uses immutable tip-<shortsha> assets in a dedicated tip update repo
• publishes the tip repo release as GitHub latest without --prerelease so /releases/latest/download/appcast.xml resolves
• preserves PR Harden release packaged smoke timeout #441 packaged-smoke hardening (env -i, explicit timeout forwarding)
• validates staged tip artifacts against a real approved-source checkout with a numeric build-number override instead of weakening stable validation

Docs/tests:

• documents Tip Builds behavior, secrets, and intentional non-Sentry tip lane
• adds release-tooling coverage for the tip workflow safety invariants
• adds app-side channel/parser tests

Release-process safety notes

This intentionally does not touch stable promotion or stable appcast publishing. Tip publishing uses a separate repo/token and the script fails closed if configured to the source repo or stable update repo.

The staged signing path was reviewed against the stable release process and keeps the important boundaries:

• no packaged app/helper execution in secret-bearing jobs
• trusted tooling checkout separate from staged payload
• approved source checkout used for staged validation
• appcast uploaded/published only after signed artifacts exist
• PR Harden release packaged smoke timeout #441 no-secret packaged smoke preserved

Validation

• make dev-format
• python3 -m unittest Scripts.test_release_tooling.ReleaseToolingTests.test_main_tip_workflow_keeps_tip_separate_and_uses_hardened_smoke
• bash -n Scripts/main_tip_release.sh Scripts/validate_staged_release.sh
• Ruby YAML parse for .github/workflows/main-tip.yml
• make dev-test FILTER=AppPlatformUtilityRecoveryTests
• .agents/skills/rpce-contribution-check/scripts/preflight.sh commit
• .agents/skills/rpce-contribution-check/scripts/preflight.sh push

Review

Claude Fable 5 High did a thorough release-process review of the first version, found blocking sign/publish issues, and then re-reviewed the amended commit. Follow-up verdict: prior blockers resolved; no new must-fix issues found.

[baron]

Tip rollout setup is now in place.

GitHub configuration:

• Created the public artifact-only repository: https://github.com/repoprompt/repoprompt-ce-tip-updates
• Created the source repository tip-release environment, restricted to protected branches with no manual reviewer gate so passing main builds can publish automatically
• Set repository variable TIP_UPDATE_REPOSITORY=repoprompt/repoprompt-ce-tip-updates

Hardening added in 6d250df:

• Tip build versions sort between adjacent stable builds (for example 28.7.95), so stable 29 can supersede Tip cleanly
• Complete per-commit releases are detected before compilation and skipped on rerun
• Dotted build versions are validated through staging and compared correctly by the in-app updater

Local validation passed: workflow actionlint, release tooling (57 tests), Swift lint, focused AppPlatformUtilityRecoveryTests, release preflight, guardrails, and secret scans.

One credential step remains before merge/first automatic run: populate the tip-release environment with the existing signing/notarization/Sparkle values and a new fine-grained TIP_UPDATE_REPOSITORY_TOKEN scoped only to repoprompt/repoprompt-ce-tip-updates with Contents read/write. Hosted checks for 6d250df are running now.