v0.7.19
This release ships the first notarized macOS sandbox-host artifact.
The macOS platform package now uses a Developer ID signed and Apple-notarized host binary built from the exact successful main artifact run. CI also now fails closed if release artifacts do not match the release target commit.
CI hardening in this release pins GitHub Actions to immutable SHAs and updates the workflow runner stack to current Node.js and GitHub-hosted runner images.