Release v2.1.5-undead

[dayglojesus]

Cuts v2.1.5-undead. Adds the CHANGELOG.md entry; merging this to main fires release.yml via its paths: [CHANGELOG.md] trigger.

Contents

23 commits since v2.1.4-undead:

• Adopt seven stalled community fixes from the upstream PR queue #39 — seven stalled community fixes from the upstream PR queue (file browser/document view backgrounds, attr.filebrowser on focus, a clang 15 crash in Find, seconds-in-a-day in format_string, a shared_ptr cast in RMateServer, the Monterey vfork warning, a Preferences typo)
• Build tooling: make the Ruby helper scripts Ruby 3 compatible #38 — Ruby 3 compatibility for the build helpers (ERB modernization, DBM → JSON cache in gen_credits.rb)
• Remove the SyntaxMate XPC service #40 — removal of the unused SyntaxMate XPC service
• Gate Apple signing secrets behind the release environment #34 / Pin actions/checkout to a full commit SHA #35 / Add CODEOWNERS #36 — release-infrastructure hardening

Every bullet is tied to a commit SHA verified against git compare v2.1.4-undead...main.

Pre-flight

Checked before opening, against the real parsers rather than assumed:

Check	Result
grep -om1 '^## .* (v.*)$' → version	2.1.5-undead
Contains -undead (guard)	yes — should_release=true
Tag v2.1.5-undead exists	no — will release
bin/extract_changes -v 2.1.5-undead	extracts this section only, exit 0
Diff shape	+32 / -0, purely additive

The extract_changes check matters: that step runs at #18, after notarization at #14, so a malformed heading would fail only after the signing cycle had been spent.

What happens on merge

1. verify (build + test) runs unapproved — no environment, no secrets.
2. release holds at "Waiting for review".
3. On approval: sign → notarize → staple → publish tag v2.1.5-undead and a GitHub release with a .tbz.

This publishes a real, public release. There is no dry-run path — the guards either skip everything or do everything.

This is also the first run to actually read the environment-scoped signing secrets. They have been verified by local round-trip (the base64 decodes to fingerprint E666E23B…, matching the keychain identity, and the recorded password opens the .p12), but never exercised in CI. If either was mis-transferred it fails at step 5, "Import signing certificate into temporary keychain" — before notarization, and cheap to recover from.

Note

The date reads 2026-08-21 (local). Adjust if it slips before merge — cosmetic, not parsed for anything but display.