OpenDisplay 0.10.0

Everything since 0.8.2 in one release: 0.9.0 was versioned in the tree but never published,
so its features ship here.

Added

• One-click updates. "Check for Updates…" now does the whole job: OpenDisplay downloads the new
  version, verifies it, installs it, and relaunches itself into it — no trip to the browser, no
  dragging a new app into /Applications. Every download is checked against the project's EdDSA
  signing key and the Developer ID signature of the copy you already have, so an update that
  doesn't come from us doesn't run. Two settings govern it: "Check for updates automatically" (on by
  default, about once a day, and it only tells you) and the opt-in "Download and install updates
  automatically". A background check that finds something never interrupts you — it leaves a version
  badge on the menu's update row and waits until you click it.

• Protected layout (Issue #38) — mark your current display arrangement as protected, and
  OpenDisplay puts it back when something else moves it. Origins, resolution, refresh,
  mirroring, and the main display are captured per display set — your laptop-alone layout and
  your desk layout are protected independently — and re-applied within seconds after hotplug,
  wake, or a stray arrangement change, with a notification saying exactly what was restored.
  Rotation drift is detected and reported, but not auto-restored: rotation writes require the
  experimental rotation helper (Labs), so a rotated-out-from-under-you display produces a
  "couldn't restore" notification rather than a silent half-restore.
  Restores run through the same checkpointed, verified, audited transaction path as every other
  change, so the always-one-display-active guarantee holds throughout; a display you deliberately
  turned off stays off, restore attempts are capped (never a tug-of-war with macOS), and the app's
  own changes never trigger a restore. Managed from Settings → Arrange, or
  opendisplay layout protect|unprotect|status.

• Display groups & brightness sync (Issue #39) — group displays so moving any member's
  brightness moves them all. Each member keeps a learned offset: nudge one display to taste and
  the group remembers the difference instead of fighting you. Optional contrast sync, media-key
  support (one OSD, on the display you're driving), and a group: selector for the CLI
  (opendisplay brightness group:desk 0.6; opendisplay group create|add|remove|list).
  Grouped displays are excluded from Adaptive Display's brightness targeting so the two features
  can't fight. Groups are configured in Settings → Displays.

Fixed

• A display you turned off no longer lights back up when the Mac wakes. With externals
  connected and the built-in panel deliberately switched off, waking the Mac brought the built-in
  back and left it on for the rest of the session. Three separate things had to be true for that,
  and all three are fixed:

  macOS relights the panel itself on wake — its display-configuration transactions don't survive a
  sleep — and OpenDisplay read that as you having switched it back on, so it forgot the display
  was ever meant to be off. It now tells the two apart, and switches the display back off once
  another screen is lit to take over (bounded, so it never turns into a tug-of-war with macOS).
  This works whether or not Protected Layout is on: a display you turned off is already an
  explicit instruction, not something that should need a second switch.

  The always-one-display-active safety net could also do it. For a second or two after a wake an
  external that is still re-negotiating its link is indistinguishable from one that was unplugged,
  and the net answered "nothing is on screen" by lighting the display you had turned off. It now
  waits for a display that is plainly on its way back — while still guaranteeing a screen within
  eight seconds no matter what the display list says, so the 0.8.2 black screen cannot return.

  And Protected Layout could not have helped, because a switched-off display leaves macOS's
  display list entirely: the moment it came back, the arrangement was filed under one display set
  and looked up under another. Protected layouts now cover the displays they keep switched off —
  in the key, in what is captured, and in what is restored.

Notes

• Updating in place only works from a build that has the updater in it. If you are on 0.8.2 or
  older, install this release by hand once; from then on OpenDisplay keeps itself current.
• Releases now carry a second asset, appcast.xml, alongside OpenDisplay.zip — that file is the
  update feed, produced and signed by scripts/release-signed.sh (see scripts/sparkle-setup.md).
• CLI edits to app-owned settings made while the app is running — group edits and
  layout protect|unprotect alike — are overwritten when the app next saves its settings.
  Quit the app first, or use the Settings window. A shared on-disk store is planned.