Harden local Apple release provenance

[PrzemyslawKlys]

Summary

• add a pinned local Apple operator that binds exact merged PSPublishModule source, consumer default branch and HEAD, repository identity, tracked inputs, and source commit
• compile from a link-free git archive snapshot and reject ignored, untracked, modified, linked, Git-replaced, submodule-backed, or process-injected build inputs
• allow only contained relative tracked symlink chains; reject escaping, cyclic, malformed, or externally materialized source links
• keep App Store Connect credentials suspended until the final sanitized CLI child, enforce an owner-only P-256 key in ~/.appstoreconnect, and reject tracked API-key and notarytool Keychain-profile overrides
• authenticate retained screenshot provenance against the successful source-bound capture run, then permit only its exact PNG/provenance paths and approval manifests whose complete path/hash/dimension inventory matches one capture root
• bind screenshot sync, Advance, review submission, and release to re-downloaded artifact identity and selected targets
• preserve rooted paths, validate enabled Xcode project/workspace/generation inputs, and let Cleanup omit only a project already removed by the completed release
• give embedded PowerShell scripts path-qualified identities so clean tracked-source builds cannot collide

CI remains limited to read-only Doctor monitoring and screenshot capture. Apple mutations remain deliberate local operations on the trusted private Mac; credentials never enter GitHub secrets or workflow artifacts.

Validation

• 406 Apple/App Store/notarization/screenshot tests and 65 focused Apple workflow tests
• executable regressions cover contained and escaping tracked links, Git submodules, notarytool Keychain-profile rejection, overlapping screenshot paths, exact ignored-evidence allowlisting, unrelated ignored siblings, and Cleanup after project removal
• zero-warning PowerForge net472/net8/net10 and CLI net10 builds on the prior candidate; current PowerShell parsing and diff checks pass
• production-shaped exact-source build excluded intentionally invalid ignored tool content
• clean-clone Tactra read-only Status succeeded with hostile .NET/CLR injection variables in the parent and no credential or private-key output

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4703494f06

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4d28940769

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bd30493529

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ac545d2a51

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 603a4d0afd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3f368b6e6c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f901898aa0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.