SilverTimer 2.4.1

Maintenance release: tooling, CI, documentation and dependency updates; no changes to app behaviour.

Added

• docs/ index and architecture decision records: an ADR template and ADRs 0001–0010 documenting existing decisions (state management and navigation, the wall-clock-anchored timer, persistence, pure calculation logic, SPM-only iOS/macOS, GPL-3.0-or-later, release automation, branching and merge policy, supply-chain pinning). The PR template and CONTRIBUTING ask for an ADR when a significant decision is made.
• Community files: CODEOWNERS, a pull request template with a Definition of Done, bug report / feature request / translation issue forms (blank issues disabled; security reports go to private vulnerability reporting), CONTRIBUTING.md and CODE_OF_CONDUCT.md (Contributor Covenant 2.1), aligned with the sibling Tideline and FoxGrid projects.
• .github/dependabot.yml: weekly updates for pub (minor/patch grouped), GitHub Actions (workflows and the local setup-flutter action) and Gradle, monthly for the Bundler/fastlane gems. The Flutter version pinned in FLUTTER_VERSION is not covered and must still be bumped by hand.
• CI workflow (.github/workflows/ci.yml) running on every pull request and push to main: dependency resolution with --enforce-lockfile, a generated-code freshness check (tool/check_generated.sh: build_runner + flutter gen-l10n must leave no diff), a formatting check of hand-written Dart files (tool/check_format.sh), flutter analyze --fatal-infos --fatal-warnings, and flutter test.
• Local composite action .github/actions/setup-flutter that installs a pinned Flutter release (3.47.7) with SDK and pub caches, shared with the sibling Tideline project's setup.

Fixed

• Release workflow: Ruby is now pinned to 3.3.6 via .ruby-version (read by setup-ruby); the Android and iOS jobs failed at bundle install because excon 1.7.2 requires Ruby ≥ 3.3 and 3.2 was hard-coded.

Changed

• CLAUDE.md rewritten in the structure used by Tideline: Workflow, Architecture rules, i18n rules, code style, Versioning, Documentation with a docs map, supply-chain rules, a Definition of Done and a command list. Reasons now live in docs/adr/; it also records the squash-merge branching flow, the SPM-only rule and the four-language ARB rule.
• Branching model: the long-lived dev branch is retired. Work happens on short-lived branches that are squash-merged into main (merge commits and rebase merges are disabled, branches are deleted on merge). CodeQL now runs on pull requests into main only. Documented in CLAUDE.md.
• Dependency updates (Dependabot group, regenerated code committed): drift 2.34.4 → 2.35.2, drift_dev 2.34.0 → 2.35.1, flutter_riverpod 3.3.2 → 3.4.3, riverpod_annotation 4.0.3 → 4.0.7, riverpod_generator 4.0.4 → 4.0.9, freezed 3.2.6-dev.1 → 4.0.1 (stable; generated *.freezed.dart reformatted), mockito 5.6.4 → 5.8.1, flutter_local_notifications 22.3.0 → 22.3.2, package_info_plus 10.2.1 → 10.2.2, shared_preferences 2.5.5 → 2.5.6, sqlite3 3.5.2 → 3.7.1, timezone 0.11.1 → 0.11.2, url_launcher 6.3.2 → 6.3.3.
• Release automation consolidated into a single .github/workflows/release.yml, started by pushing a vX.Y.Z tag. It checks the tag against the pubspec.yaml version and the CHANGELOG.md section, then builds and publishes web (GitHub Pages), Android (Play Store internal track) and iOS (TestFlight), and finally creates the GitHub release with the CHANGELOG section as notes. Running it manually (Run workflow) is a dry run unless the new publish checkbox is ticked on a tag: it builds everything, publishes nothing, and never waits for approval (fastlane skips uploads when DRY_RUN=true). On tag runs the store jobs use the production environment, so a required reviewer there gates each release. Process and secrets: new docs/release.md.
• scripts/ renamed to tool/ (bump_version.sh, take_screenshots.sh), matching the sibling projects. bump_version.sh now prints the PR-then-tag steps.
• All GitHub Actions in every workflow are now pinned to full commit SHAs (with the version in a trailing comment), so a moved tag cannot change what runs. actions/checkout moves from v4 to v7.0.1 to match CI.
• Deploy, CodeQL and screenshot workflows install Flutter through the local setup-flutter action at the pinned version (FLUTTER_VERSION in each workflow's env, currently 3.47.7) instead of subosito/flutter-action on the moving stable channel. When bumping Flutter, update that value in all workflows.
• Reformatted test/shared/widgets/app_width_constraint_test.dart, the only hand-written file that was not dart format clean.

Removed

• Unused cupertino_icons dependency (nothing in the app referenced CupertinoIcons; the app's Cupertino widgets and colors come from Flutter's own cupertino.dart).
• bump-version.yml, create-release-tag.yml, deploy-web.yml, deploy-ios.yml and deploy-android.yml, replaced by release.yml. The auto-tag workflow is gone because a tag pushed with GITHUB_TOKEN never started the deploy workflows (they were being run by hand); tag releases yourself as described in docs/release.md.

Security

• Bumped fastlane from 2.237.0 to 2.241.0, which lifts its rubyzip pin and lets the transitive rubyzip gem move from 2.4.1 to 3.7.0, fixing a path traversal vulnerability (Dependabot alert #14, high severity, patched in 3.4.0). fastlane only runs in CI/local release tooling, not in the shipped app. Other gems in Gemfile.lock (e.g. aws-sdk-*) were updated transitively.