v0.8.1

Rio v0.8.1

macOS now trusts Rio on its own: signed by rebaze, notarized by Apple.

This is what Gatekeeper reports for the macOS binary. The release verification checks exactly
these lines for the published archive, and for the Homebrew install with its quarantine mark
still in place:

$ spctl -a -vv -t install "$(command -v rio)"
/opt/homebrew/bin/rio: accepted
source=Notarized Developer ID
origin=Developer ID Application: rebaze GmbH (32Z95ATB2T)

What changed

• The darwin binaries are signed with rebaze's Developer ID and notarized by Apple during the
  release, before archiving, so the archives, checksums, cosign signature and attestations all
  cover the signed bytes. A release without the signing credentials fails instead of falling
  back to unsigned macOS binaries.
• The Homebrew cask no longer strips com.apple.quarantine after install. Gatekeeper checks
  the binary instead of being bypassed, and brew install rebaze/tap/rio keeps working
  without --no-quarantine.
• Cosign, Syft and GoReleaser now come from their official GitHub Actions, pinned by commit,
  instead of being rebuilt from source in the release job.
• The recovery demonstrations are merged into one: tools/demo-recovery.
• Updated doublestar to 4.10.3 and the create-github-app-token and Scorecard action pins.

Rio's commands, flags, manifest and receipt format are unchanged from v0.8.0.

To check a macOS binary yourself, see installation.
Linux and Windows binaries are verified as before, through the cosign-signed checksums and
GitHub attestations; Windows Authenticode signing is not part of this release.