CoreTend 0.9.1-rc.1 (release candidate)

CoreTend 0.9.1-rc.1 (release candidate) — Not a 1.0

This is a release candidate, not a stable 1.0. It follows 0.9.0 with a set of
concrete fixes and no feature changes. It carries the same disclosures as
0.9.0 below, plus one new one.

Why this isn't 1.0

The COREXTEND trademark watch item recorded in
Documentation/CORETEND_TRADEMARK_SCREENING.md is unresolved, and
legalReviewStatus in Documentation/PROJECT_STATE.json remains pending.
No legal or trademark clearance is claimed for this build. A stable 1.0 is
withheld until that review concludes.

What changed since 0.9.0

• Fixed a flash of unstyled content (default blue links, no styling) on the
  website's language-splash page. The first fix used inline CSS/JS, which
  the site's own Content-Security-Policy would have silently blocked in
  production — caught and corrected before release.
• Fixed swift test failing on machines without Xcode.app installed
  (no such module 'Testing') by declaring swift-testing as an explicit,
  pinned dependency. Test-target only — no change to the shipped app.
• Fixed the ClamAV onboarding step's "Recheck" button, which could never
  detect a ClamAV binary installed mid-onboarding. Added a "Copy Install
  Command" button alongside it.
• Fixed Scripts/test-uninstall.sh, which targeted the real
  /Applications/CoreTend.app regardless of its test fixture's fake home
  directory — a real install could have been deleted by running this test.
  Now fully isolated.

Still true from 0.9.0

CoreTend is not signed and not notarized. security find-identity -v -p codesigning reports zero valid identities on the build machine — signing
requires a paid Apple Developer Program membership this project does not
have. The app is simply unsigned, and says so.

macOS will refuse to open it on first launch. Right-click (or
Control-click) CoreTend in Finder and choose Open, then confirm. Do this
once. Full instructions, including how to verify the download's SHA-256
first, are in Documentation/INSTALL_UNSIGNED.md.

Do not disable Gatekeeper to install this.

Verify what you downloaded before opening it: compare its SHA-256 against
the one published alongside this release with shasum -a 256 <file>.