agent: lumotia — v0.1 release-completion run

Closes the code-side v0.1 ship gate. All quality gates green:
cargo fmt/clippy/test (~327 tests), npm check (0/0), vitest 13/13,
scripts/dogfood-rebrand-drill.sh 8/8.

Phase F — first-run onboarding promoted to v0.1
- FirstRunPage with skip-to-main + failure recovery + event recording
- Six onboarding commands (record/list/has-completed + lumotia_events)
- Storage migration v17 (onboarding_events + lumotia_events tables)

UI hardening (in-scope items from v0.1-ui-hardening.md)
- StatusPill + PostCaptureCard components, 21st preview entry
- Sidebar recording-as-sacred-state (opacity + aria-disabled, reduced-motion)
- Settings 6-section regroup + Help section + Activation log + Privacy toggle
- Error-state copy sweep (DictationPage + SettingsPage, plain-language)
- Global :focus-visible rule, textarea outlines restored
- Ctrl+K / Ctrl+, / Escape bindings in +layout

LLM resilience
- rule_based_extract_tasks (regex-free imperative-verb extractor) +
  extract_tasks_with_fallback wrapper — task extraction never returns zero
- tokio::time::timeout(120s) wraps cleanup/tags/tasks commands

Release artefacts
- LICENSE (canonical AGPL-3.0), CHANGELOG (Keep-a-Changelog format)
- v0.1-release-notes, privacy-and-ai-use, install-warnings,
  tester-onboarding-kit, tester-acceptance-runbook, code-signing-setup,
  apple-silicon-rb08-runbook, virtual-audio-setup, v0.1-contrast-audit
- Workspace versioning + AGPL spdx; npm exact-pin (10 ranges removed)
- AppImage SHA-256 sidecar in build.yml
- README v0.1 section + Reporting-issues; canonical repo slug

Closure pass — items moved from human-required to code-complete
- KI-02 Linux idle inhibit: zbus 5 → org.freedesktop.login1.Manager.Inhibit
- KI-03 Windows sleep prevention: SetThreadExecutionState(ES_CONTINUOUS|...)
- acquire/release_idle_inhibit Tauri commands, wired in DictationPage
- Diagnostic-bundle frontend wire-up (Settings → Help button)
- WCAG-AA contrast fix via .btn-filled-text utility (no token changes)
- 8 destructive-action sites wrapped in plain-language confirm() guards
- KNOWN-ISSUES.md + v0.1-known-limitations.md updated (KI-02/03 fixed)

Scripts
- pre-tag-verify.sh, tag-day.sh, smoke-linux + driver
- parse-diagnostic-bundle.sh, parse-activation-log.py

Per-item audit trail: docs/release/v0.1-completion-status.md
Remaining: W-01…W-08 (signing certs, hardware probes, smoke matrix,
tester recruitment) — see docs/release/v0.1-known-limitations.md.

.github/workflows/build.yml

@@ -14,13 +14,12 @@
 #   Promote the draft to a release when ready.
 #
 # Signing:
-# - macOS code-signing not configured. The .dmg will trigger Gatekeeper
-#   warnings on the first run; users will need to right-click → Open.
-#   To wire signing later, set APPLE_SIGNING_IDENTITY +
-#   APPLE_CERTIFICATE secrets and uncomment the env block.
-# - Windows code-signing not configured. The .exe/.msi will trigger
-#   SmartScreen warnings on first run. To wire signing later, set
-#   WINDOWS_CERTIFICATE + WINDOWS_CERTIFICATE_PASSWORD secrets.
+# - macOS: signing + notarisation activate automatically when the
+#   APPLE_* secrets are set in the repo. Builds unsigned if absent.
+#   See docs/release/code-signing-setup.md for the cert walkthrough.
+# - Windows: signing activates automatically when WINDOWS_CERTIFICATE
+#   + WINDOWS_CERTIFICATE_PASSWORD are set. Builds unsigned if absent.
+#   See docs/release/code-signing-setup.md for the cert walkthrough.
 name: build
 
 on:
@@ -48,6 +47,7 @@ jobs:
           - os: ubuntu-22.04
             artifact_glob: |
               src-tauri/target/release/bundle/appimage/*.AppImage
+              src-tauri/target/release/bundle/appimage/*.AppImage.sha256
               src-tauri/target/release/bundle/deb/*.deb
           - os: windows-latest
             artifact_glob: |
@@ -143,12 +143,20 @@ jobs:
         uses: tauri-apps/tauri-action@v0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # Uncomment when signing certs are configured in repo secrets:
-          # APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
-          # APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          # APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          # WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-          # WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
+          # macOS code-signing + notarisation. Builds unsigned if these secrets aren't set.
+          # Set via: gh secret set APPLE_SIGNING_IDENTITY --body "..." (etc.)
+          # See docs/release/code-signing-setup.md for the cert procurement walkthrough.
+          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          # Windows code-signing. Builds unsigned if these secrets aren't set.
+          # Set via: gh secret set WINDOWS_CERTIFICATE --body "..." (etc.)
+          # See docs/release/code-signing-setup.md for the cert procurement walkthrough.
+          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
         with:
           # If pushed as a tag, use the tag name; otherwise leave empty
           # so tauri-action builds artifacts but does not touch releases.
@@ -159,6 +167,18 @@ jobs:
           # Build all bundle types the OS supports.
           args: ''
 
+      - name: Compute AppImage SHA-256
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          set -euo pipefail
+          cd src-tauri/target/release/bundle/appimage
+          for img in *.AppImage; do
+            sha256sum "$img" > "$img.sha256"
+            echo "Generated: $img.sha256"
+            cat "$img.sha256"
+          done
+
       # Always upload as an Actions artifact too — accessible from the
       # workflow run page even if the release-creation step was skipped.
       - name: Upload artifacts