noholdpay-recover v1.0.0

Self-recovery CLI

This is the platform-offline recovery path. Run the binary against
your downloaded recovery kit and a public RPC URL to re-derive and
sweep your forwarder addresses using your own control key, with no
platform involvement required.

Per-platform binaries are signed with Sigstore Cosign (keyless,
GitHub Actions OIDC). Verify before running:

cosign verify-blob \
  --bundle <asset>.sigstore.json \
  --certificate-identity-regexp '^https://github\.com/NoHoldPay/noholdpay/\.github/workflows/release-recover-cli\.yml@refs/tags/recover-cli/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  <asset>

Substitute <asset> with the exact filename you downloaded
(the Windows build ends in .exe).

The identity names the private repository this binary was built in.
That is expected: keyless signing binds the signature to the exact
workflow, commit and tag that produced the artifact, and the
certificate is checked as a string against a Fulcio-issued cert -
verification never contacts that repository and needs no access to
it. The regexp is anchored to this one workflow file and the
recover-cli/ tag prefix on purpose; a trailing /.* would accept
a signature from any workflow on any ref in the repo.

See the recovery kit export and dependency-free recovery CLI
sections in docs/runbooks/EVM_PAYMENTS_END_TO_END.md for the full
walkthrough.